Watch EDR see, and not see

short · 50 min · Objective 1.3

Task

Run a sequence of benign actions through an endpoint agent and record, for each, whether it was blocked, alerted, logged silently, or invisible. Those four outcomes are different, and a coverage claim that does not distinguish them is the most common way a matrix ends up green and wrong.

Steps

  1. Write the EICAR test string to a file. Record what happened: blocked at write, quarantined after, alerted, or nothing.
  2. Run whoami, net group "Domain Admins" /domain, and reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Record the outcome for each.
  3. Create persistence with a scheduled task that runs notepad.exe daily. Record the outcome. Delete it.
  4. Copy cmd.exe to %TEMP%\svchost.exe and run it. Record the outcome -- this is a renamed-binary test and it separates name-matching from behaviour-matching.
  5. Build the table: four columns, one row per action, marking blocked / alerted / logged only / nothing at all.

Verify

powershell -c "Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 500 | Where-Object {$_.Id -eq 1 -and $_.Message -match 'svchost.exe'} | Measure-Object | Select-Object -Expand Count"
powershell -c "Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -MaxEvents 500 | Where-Object {$_.Id -eq 1 -and $_.Message -match 'OriginalFileName.*Cmd.Exe'} | Measure-Object | Select-Object -Expand Count"
powershell -c "(Get-ScheduledTask | Where-Object {$_.TaskName -match 'lab'}).Count"

The first two are the point. Both must be non-zero, and they show the same event found two ways: by the name the attacker chose, and by the name compiled into the binary. OriginalFileName does not change when a file is renamed, which is why a detection built on it survives and one built on the filename does not.

Notes

Count the rows in your table that say "logged only". Those are detections you do not have but could have today, at the cost of writing a rule -- they are the cheapest security improvement available anywhere.

Count the rows that say "nothing at all". Those are the telemetry gaps, and no rule fixes them.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.