Examkin

Soru

Zorluk: OrtaEndpoint Detection and Response (EDR)

A security analyst is investigating a suspected threat actor moving laterally within an enterprise network. The edge firewall recorded no unauthorized inbound traffic, and the legacy signature-based antivirus on host endpoints reported zero malicious file detections. However, the Endpoint Detection and Response (EDR) agent flagged an active alert when a natively trusted system utility, `wmic.exe`, was executed by a parent process to delete volume shadow copies. Which of the following capabilities of EDR enabled the identification of this malicious activity?

  1. Continuous behavioral telemetry monitoring and process lineage trackingCevap
  2. B
    Static binary hashing and signature comparison against known malware databases
  3. C
    Deep packet inspection and payload analysis at the network edge
  4. D
    Automated network access control list updates to block external IP ranges

Cevap

Continuous behavioral telemetry monitoring and process lineage tracking
The correct answer highlights EDR's core strength: continuously capturing process execution context, command-line arguments, and parent-child process relationships. Because `wmic.exe` is a legitimate Windows binary, legacy signature scanners mark it as clean. EDR detects the threat by analyzing the anomaly in behavioral telemetry and process lineage when an administrative tool is invoked inappropriately.

Adım Adım Çözüm

1
Analyze the attack mechanism described in the scenario
The attacker utilized a legitimate, signed system utility (`wmic.exe`) to execute a command, bypassing file-based antivirus signatures.
Living off the Land (LotL) attacks rely on native OS binaries that carry valid signatures.
2
Evaluate why perimeter and signature controls failed
Perimeter firewalls only inspect boundary network traffic, and legacy AV relies on known bad file hashes.
Valid OS utilities do not trigger file signature alerts or perimeter boundary violations.
3
Identify the specific EDR mechanism that triggered the detection alert
EDR records continuous endpoint behavioral telemetry, including process creation trees (parent-child process execution lineage).
Detecting unusual execution contexts of legitimate binaries requires analyzing process behavior and execution chains.

Anahtar Kavram

EDR Behavioral Telemetry and Process Lineage
Bu soruyu puanla

Konular

Endpoint Detection and Response (EDR)

Bu konudan daha fazla soru