Endpoint detection and response (EDR)

Endpoint Detection and Response (EDR) is no longer optional. It is a core pillar of cybersecurity and regulations mandate EDR.

---

Vulnerability scanners @GitHub

• Windows vulnerability scanner
• MacOS vulnerability scanner
• Linux vulnerability scanner
• Android vulnerability scanner
• iOS vulnerability scanner

---

Tools @Testlab

• Endpoint Detection and Response tools
• Threat hunting tools

---

macOS EDR techniques

• Introduction
• Process monitoring
• Memory protection
• Behavioural detection
• Network hardening

---

Linux EDR techniques

• Introduction
• Kernel-level monitoring
• Filesystem integrity
• Container security
• Threat Hunting with Open Source

---

Windows EDR techniques

• Introduction
• Process & behaviour monitoring
• Memory protection
• Attack Surface Reduction (ASR)
• Network threat detection
• Persistence and logging
• Response techniques

---

EDR shell scripts @GitHub

• Windows EDR powershell script
• MacOS EDR shell script
• Linux EDR shell script

---

TryHackMe Room

Windows core

• Introduction
• smss.exe
• csrss.exe
• wininit.exe
• services.exe
• svchost.exe
• lsass.exe
• winlogon.exe
• explorer.exe

Windows sysinternals

• Introduction
• File and disk utilities
• Networking utilities
• Process utilities
• Security utilities
• System information
• Miscellaneous

Windows event logs

• Introduction
• Event logs
• XPath queries
• Scenarios

Sysmon

• Introduction
• Event IDs
• Cutting out the noise
• Hunting metasploit
• Detecting mimikatz
• Hunting malware
• Hunting persistence
• Detecting evasion techniques
• Practical investigations

Osquery basics

• Introduction
• Osquery shell
• Schema documentation
• Creating queries