Endpoint detection and response (EDR)

Configure and use tooling to detect suspicious activity.

---

Testlab

• Endpoint Detection and Response tools

---

Windows core

• Introduction
• smss.exe
• csrss.exe
• wininit.exe
• services.exe
• svchost.exe
• lsass.exe
• winlogon.exe
• explorer.exe

Windows sysinternals

• Introduction
• File and disk utilities
• Networking utilities
• Process utilities
• Security utilities
• System information
• Miscellaneous

Windows event logs

• Introduction
• Event logs
• XPath queries
• Scenarios

Sysmon

• Introduction
• Event IDs
• Cutting out the noise
• Hunting metasploit
• Detecting mimikatz
• Hunting malware
• Hunting persistence
• Detecting evasion techniques
• Practical investigations

Osquery basics

• Introduction
• Osquery shell
• Schema documentation
• Creating queries