10.2 Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR)

Evolution from Legacy Antivirus to Endpoint Detection and Response (EDR)

For decades, traditional Antivirus (AV) served as the primary endpoint defense layer. Legacy AV operates primarily on signature-based detection, comparing file hashes (MD5/SHA-256) and static byte sequences against databases of known malware. While effective against widespread commodity threats, signature-based AV fails completely against modern adversarial tradecraft:

• Polymorphism and Metamorphism: Adversaries recompile malware or use automated crypters and packers to alter file hashes continuously while maintaining identical malicious execution logic.
• Fileless and In-Memory Attacks: Exploits execute entirely in volatile memory using reflective DLL loading, process hollowing, or process doppelganging, leaving zero binary footprints on physical non-volatile disk.
• Living Off the Land Binaries (LOLBins): Threat actors leverage legitimate operating system administrative utilities—such as powershell.exe, wmic.exe, certutil.exe, mshta.exe, and rundll32.exe—to bypass signature defenses.

To counter these threats, Endpoint Detection and Response (EDR) shifted the security paradigm from prevention-only inspection to continuous telemetry recording, behavioral analysis, and automated response.

---

EDR Architecture and Kernel-Level Sensor Telemetry

An enterprise EDR solution consists of a lightweight endpoint agent paired with a scalable cloud-native analytics backend and data lake. The agent continuously records high-fidelity endpoint events and constructs real-time behavioral process execution trees.

EDR Sensor Kernel Hooking Mechanisms

To capture tamper-resistant telemetry and prevent user-space malware from blinding the sensor, EDR agents operate deep within the operating system kernel:

• Windows Kernel Callbacks & Minifilters:
  • PsSetCreateProcessNotifyRoutineEx: Intercepts process creation events, capturing parent-child process relationships, image paths, user security contexts, and full command-line arguments.
  • PsSetCreateThreadNotifyRoutine: Intercepts thread creation, critical for detecting process injection techniques (e.g., CreateRemoteThread).
  • ObRegisterCallbacks: Restricts and monitors process handle duplication, protecting critical processes like lsass.exe against credential dumping attempts (e.g., Mimikatz).
  • CmRegisterCallbackEx: Intercepts Windows Registry reads and writes to detect persistence mechanisms (Run keys, service configurations).
  • File System Minifilter Drivers: Intercepts file I/O operations (creation, modification, deletion) to detect ransomware encryption surges or unauthorized staging.
• Linux eBPF (extended Berkeley Packet Filter):
  • Modern Linux EDR sensors utilize eBPF rather than legacy Loadable Kernel Modules (LKMs). eBPF allows the security sensor to execute sandboxed, verified bytecode inside the Linux kernel at native execution speed.
  • It captures low-overhead telemetry on critical system calls (sys_enter_execve, sys_enter_connect, sys_enter_openat) without risking kernel panics or operating system instability.

Core Telemetry Captured by EDR Sensors

1. Process Lineage: Parent Process ID (PPID), Process ID (PID), Image Path, Command-Line strings, hash, and code-signing status.
2. Network Activity: Inbound/outbound TCP/UDP sockets, destination IP/port, DNS queries generated by specific PIDs.
3. File System Events: File creation, modification, deletion, file entropy measurements, and canary file tripwires.
4. Registry Modifications: Modifications to startup keys, service registrations, and LSA security providers.

---

EDR Live Response Capabilities

When a high-fidelity behavioral anomaly triggers an alert, EDR platforms provide SOC analysts with Live Response tools to investigate and remediate endpoints remotely without requiring physical access:

• Remote Interactive Shell: Provides an encrypted, auditable administrative terminal directly into the endpoint over the EDR agent's authenticated TLS channel. Responders can execute diagnostic commands, enumerate running services, inspect network sockets, and pull forensic artifacts.
• Process Termination & Memory Acquisition: Responders can surgically terminate malicious processes and their spawned child trees (kill -9 or TerminateProcess). Furthermore, analysts can dump volatile process memory (e.g., memory dumping an injected svchost.exe) for offline extraction of Cobalt Strike beacon configurations.
• File Quarantine & Remediation: Malicious executables, scripts, and persistence keys are moved to an encrypted quarantine vault on the host or purged directly.
• Host Network Isolation (Containment): An authorized analyst can request endpoint network isolation from the EDR console. Actual enforcement, supported platforms, allowed management traffic, exclusions, latency, and failure modes vary by product and configuration. The responder confirms the action succeeded and which EDR or remediation channel remains reachable; isolation reduces network movement but does not guarantee complete containment or uninterrupted investigative control.

---

Extended Detection and Response (XDR): Architectural Paradigm

While EDR revolutionized endpoint visibility, modern multi-stage intrusions span diverse architectural boundaries. Attackers exploit cloud identities, leverage unmanaged network devices, compromise email gateways, and pivot through containerized cloud workloads. Because standalone EDR cannot observe cloud control plane API calls or network-level lateral movement between unmanaged assets, the industry evolved toward Extended Detection and Response (XDR).

Native XDR vs. Hybrid (Open) XDR

Organizations deploy XDR along two primary architectural philosophies:

---

Cross-Telemetry Correlation in Action

The fundamental power of XDR lies in cross-domain correlation: binding isolated, low-fidelity telemetry signals across multiple independent security layers into a single high-confidence attack narrative.

Consider an advanced spear-phishing attack traversing the enterprise kill chain:

1. Email Layer: An executive receives an email containing a link to an external document. The email gateway scores the message as low risk because the domain was registered recently and has no prior malicious reputation.
2. Identity Layer: Minutes later, the identity provider (IdP) logs a successful web authentication for the executive, but notes an atypical user-agent and an unfamiliar ISP geolocation.
3. Endpoint Layer (EDR): The user opens a downloaded payload. EDR records WINWORD.EXE spawning cmd.exe, which executes an obfuscated powershell.exe command with encoded arguments.
4. Network Layer (NDR / Firewall): The endpoint initiates an outbound HTTPS session to an external IP. The NDR sensor notes regular periodic beaconing intervals (jitter) indicative of C2 communication.
5. Cloud Layer (CWPP): Thirty minutes later, the executive's cloud credentials are used to generate a new administrative service principal in Microsoft Entra ID / AWS IAM.

[XDR Multi-Domain Correlation Engine]
Email Gateway       --> Inbound Phishing Link Delivered   (Signal: Low)
Identity Provider   --> Anomaly Geolocation Authentication (Signal: Medium)
Endpoint EDR        --> Word Spawns Obfuscated PowerShell  (Signal: High)
Network NDR         --> Outbound Encrypted C2 Beacon       (Signal: High)
Cloud Workload/IAM  --> Privileged Service Principal Added (Signal: High)
                           │
                           ▼
        [XDR Root-Cause Correlation Algorithm]
  Single Correlated Incident: Advanced Targeted Intrusion (P1-Critical)

In a disconnected SOC, an analyst triaging the email alert alone would see nothing critical. However, the XDR correlation engine links these five disparate telemetry streams by user identity, host GUID, and timestamp, instantly synthesizing a unified P1 incident ticket with a reconstructed root-cause attack graph.

---

Comparative Capabilities: EDR vs. SIEM vs. SOAR vs. XDR

Security Operations Centers combine complementary technologies to manage enterprise defense. Understanding the architectural differences between EDR, SIEM, SOAR, and XDR is critical for SOC engineering: