11.1 EDR vs AV, Telemetry, Containment, Remote Shell

11.1 EDR vs AV, Telemetry, Containment, Remote Shell

When a workstation misbehaves — a user reports a fake invoice attachment, a SIEM alert names a hostname, or threat intel lists a hash — the Security Operations Center (SOC) Level 1 analyst's richest host evidence is usually the Endpoint Detection and Response (EDR) console. EDR is a host-based security capability: an agent on the endpoint records activity continuously, detections fire on behaviour as well as known-bad files, and responders can act on the device itself. This independent OpenExamPrep chapter covers SAL1 topics in Endpoint Detection and Response so you can read that console, explain what traditional antivirus (AV) would have missed, and know which response actions belong to L1 versus later tiers.

SAL1 treats EDR as a tools-of-the-trade skill, not a vendor-certification dump. You need the job concepts: what the agent collects, how it is deployed, how detection differs from response, and why a clean AV scan is not a clean host.

Functionality: collect, detect, and respond

An EDR platform stacks three jobs.

Collect. The agent records telemetry — timestamped records of process starts, command lines, parent-child process relationships, file writes, module loads, registry or plist changes, local authentication events, and network connections initiated from the host. That stream is the investigation record. Even when no alert fires, many products keep a rolling history so an analyst can ask what happened on this laptop between 14:00 and 14:20.

Detect. Analytics on that telemetry look for sequences, not only a matching file. Encoded PowerShell spawned by a browser, Local Security Authority Subsystem Service (LSASS) memory access, a signed Windows binary used in an unusual way (living off the land), or a burst of file renames consistent with ransomware are behavioural stories. Signature and hash matches still exist; they are one input, not the whole product.

Respond. From the same console, an authorized analyst can contain or isolate the host, kill a process, quarantine a file, pull additional artifacts, or open a remote shell (live-response session) to run approved commands. Detection without response leaves the attacker on the box. Response without telemetry is guessing.

Deployment: coverage is part of the finding

EDR is only as good as its coverage. Typical install paths include a software distribution tool, a Group Policy Object (GPO) or mobile-device-management push, a gold image for new builds, or a manual installer for exceptions. The agent needs enough privilege to observe process creation and, on Windows, mechanisms similar to Event Tracing for Windows (ETW). The console may be vendor cloud or on-premises.

Coverage gaps are exam-relevant. Unmanaged contractor laptops, lab virtual machines built from old images, servers whose owners blocked the agent, and bring-your-own-device (BYOD) phones often have no EDR. Dual-running with a legacy AV product can cause performance fights and exclusion lists that accidentally hide malware folders. Cloud workloads may use a different sensor than user laptops. The L1 skill is noticing that this hostname is not in EDR, not assuming the tool saw everything.

Sensor health matters as much as detections. An agent that has been uninstalled, stuffed into debug exclusions, or has stopped reporting is itself an investigation lead. During triage, check last-seen time before you conclude the host is quiet.

EDR versus traditional antivirus

Traditional AV grew up as on-access and scheduled scanners. It compares files to signatures: hashes, byte patterns, and sometimes simple heuristics. When it matches, it quarantines or deletes the file. That model is fast for known commodity malware. It fails when the file is new, packed, decrypted only in memory, or never written as a malicious portable executable at all.

Modern next-generation antivirus (NGAV) blurs marketing labels: many suites bundle a signature engine plus behavioural EDR. For SAL1, keep the conceptual split. If the control only says this hash is known bad, think AV. If the control reconstructs a process tree and offers isolate, think EDR.

Detection: telemetry and behavioural analysis

Detection starts with fields L1 analysts actually read.

Behavioural analysis scores a sequence. One PowerShell window is common on a helpdesk PC. PowerShell with a long encoded blob, spawned by winword.exe two seconds after a macro-enabled document opened, then creating a scheduled task, is a story. The EDR engine maps that story to detections; detection engineers — not typical L1 analysts — tune those rules.

L1 analysts use console data. They usually do not write detections yet. Authoring a new behavioural rule, suppressing a noisy one globally, or deploying a custom indicator is detection engineering, a common security activity covered later in this study guide. On the exam and on the job, L1 documents what the existing detection showed, whether it looks like a true positive, and what evidence supports escalation.

Worked example: AV signature miss versus EDR process-tree alert

Scenario. A finance user receives an email with Q3-invoice.pdf.exe. Traditional AV has no signature. The file is packed; the hash is unknown. The user double-clicks it.

What AV sees. On-access scan: unknown executable, no match, allow execute. A later periodic scan still has nothing to match if the packer mutated. A ticket that only ran an AV scan would say AV clean.

What EDR records.

1. explorer.exe (the user) leads to chrome.exe (the download) leading to Q3-invoice.pdf.exe from C:/Users/jpatel/Downloads/.
2. Child: powershell.exe -NoP -NonI -W Hidden -enc followed by a long blob.
3. Child of PowerShell: rundll32.exe with an unusual export, plus an outbound HTTPS connection to 198.51.100.153 on port 443.
4. File writes under %APPDATA%/UpdateSvc/ including a persistence Run key.

The EDR alert title is not known malware XYZ. It is a behavioural name such as suspicious encoded PowerShell spawned from a user download, followed by rundll32 and outbound HTTPS.

L1 walkthrough. Open the alert. Confirm hostname, user, and timestamp. Expand the process tree; copy the command line into the case. Note the parent (browser download) — that is an initial-access flavour, not a server-side web shell. Enrich the hash and destination IP, but do not close as false positive just because a public reputation site is still empty. Check whether other hosts show the same child process. If the playbook allows L1 isolation for this severity, contain the host; otherwise escalate with the tree, hashes, and destination. Do not spend L1 time writing a new EDR rule in the product.

The teaching point: AV missing a signature is expected. EDR alerting on the process tree is the point of the tool.

Response: isolate, contain, and remote shell

Isolate, meaning network containment of the host, is the response action L1 playbooks mention most. The EDR agent keeps a management channel to the console, but other traffic is blocked. That cuts command and control (C2) and lateral movement (Server Message Block (SMB), Remote Desktop Protocol (RDP)) while you still collect evidence. Isolation is not a wipe and not a power-off; memory and disk remain for forensics.

Containment is the broader family: isolate this host, disable the user, block the hash across the fleet, sinkhole the domain at Domain Name System (DNS), and ticket identity and network teams. EDR is one actuator, not the whole containment plan.

Remote shell (live response) opens an approved command channel on the host. Uses include collecting a specific file, listing scheduled tasks, or dumping additional logs the agent did not already ship. It is high privilege. A mistyped command can destroy evidence or alert the attacker. Many SOC models reserve interactive remote shell for L2 or incident response. L1 may see output attached to a case; they should not freelance reconnaissance on production endpoints.

Kill-process and quarantine-file are narrower. Killing powershell.exe without isolation may leave the dropper and persistence. Quarantining one file without reading the tree misses siblings.

Traps for the exam and the console

A green AV icon does not mean no endpoint incident. Hash reputation lag is normal for fresh samples; behaviour still counts. Isolation that is too late still matters: it stops the next hop. Remote shell is a response feature, not a detection feature. If the agent last checked in yesterday, you do not have live telemetry — say so in the ticket.