19 — Endpoint Security
Level: Intermediate · Time: ~18 min · Prerequisites: Lesson 18 — Network Security Controls
Why this matters
Lesson 18 built the walls between your zones. This lesson is about the room where the work actually happens. Documents are written on endpoints, email is read on endpoints, credentials are typed into endpoints, and the database client that reaches your most valuable server runs on an endpoint. It is also where nearly every intrusion ends up: the phishing link opens in a browser, the macro runs inside a document, the USB stick is plugged into a laptop. Network controls decide how far an attacker travels after they land. Endpoint controls decide whether they land at all, and what they can do in the first ten minutes when they do.
The mental model: the last metre
Every endpoint answers three questions, and almost every endpoint control exists to change one of those answers.
| Question | Bad answer | The control families that change it |
|---|---|---|
| What is allowed to run here? | anything the user can download | application allowlisting, execution policies, EDR |
| Who has privilege here? | every user is a local administrator | admin rights removal, separate admin accounts, patching |
| What happened here? | nothing is recorded | EDR telemetry, host logging (Lesson 22) |
The third row is the one beginners skip and practitioners care about most. A control that stops an attack is valuable once. A control that records an attack is valuable every time afterwards, because it feeds detection (Lesson 23) and incident response (Lesson 24).
Traps to avoid. Treating antivirus as endpoint security. Assuming "we have EDR" means "we are covered". Buying tooling before removing local administrator rights, which is free and stops more real incidents than most paid products.
From signature antivirus to behavioural EDR
Antivirus was built on a signature: a byte pattern or hash identifying known-bad code. That model still works for known malware and still fails on everything else.
| Generation | What it matches on | What it can see well | What it is blind to |
|---|---|---|---|
| Signature AV | a known-bad file pattern or hash | mass-market malware, commodity ransomware, files already seen by the vendor | anything new, anything repacked, anything the attacker wrote for you |
| Heuristics / sandboxing | suspicious structure or behaviour in an isolated environment | slightly modified variants | anything that detects it is in a sandbox, or that waits days before acting |
| Behavioural EDR | the actions of processes, not their contents | script interpreters, living-off-the-land tooling, credential access, process injection | anything the agent cannot observe, and anything that looks normal |
The practical consequence: signature-only defence fails on the malware that matters most — the code written for your organisation, or a known tool recompiled minutes before delivery, for which no signature exists yet. This is why attackers pack, rename and re-sign their payloads as routine hygiene: it is cheap, and it defeats a large share of the market.
An EDR agent works differently. It sits on the host, watches kernel-level events, and builds a picture of a process from birth to death: what started it, what it wrote, what it connected to, and which user owned it. It flags behaviour that is suspicious regardless of which file performed it.
What EDR telemetry actually contains
This table is the reason Lessons 23 and 26 keep coming back to endpoints. If you record these six things, an analyst can reconstruct almost any intrusion.
| Telemetry | Example | What an analyst does with it |
|---|---|---|
| Process creation, with full command line | powershell.exe -enc SQBFAFgA... |
the single most valuable field on a modern host; it reveals the tool, the arguments and the intent |
| Parent–child process relationships | WINWORD.EXE → cmd.exe |
Office does not normally start shells; this chain is a phishing payload almost every time |
| File writes and drops | a .exe written into C:\Users\…\AppData\Local\Temp\ |
droppers, staging, and ransomware encryption behaviour |
| Registry changes | a new value under a Run key | persistence that survives reboot |
| Network connections | process → 203.0.113.44:443 |
command and control, lateral movement, exfiltration |
| Executing user identity | CORP\jsmith |
ties action to account, which ties the endpoint to the identity investigation in Lesson 20 |
A single record from a real agent looks roughly like this:
2026-09-14 09:12:44 host=WKS-014 user=CORP\jsmith
process: C:\Users\jsmith\AppData\Local\Temp\invoice_2026.pdf.exe (pid 6412)
parent: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE (pid 3120)
command: "invoice_2026.pdf.exe" /q /silent
network: 203.0.113.44:443 (tcp, established)
Nothing here is a signature match. Word has a clean hash, the destination is an ordinary-looking IP, the user is real. The finding is the relationship: a document reader launched a binary out of a temporary directory and it opened an outbound connection. That is the difference between matching and detecting.
[!TIP] When you are asked to design detections, start with what you already have. On Windows, Sysmon (free, Microsoft) provides process creation with command line, network connections, file creation and registry events; the equivalent on Linux is auditd with a process-execution rule. Both are discussed in Lesson 22, and Lesson 35 covers shipping it all to a central collector.
Allowlisting, privilege and patching: the three controls that change the odds
Application allowlisting
Allowlisting is the strongest single endpoint control. Everything is blocked except what is explicitly permitted, defined by one of three rule types:
| Rule type | Says | Strength | Weakness |
|---|---|---|---|
| Publisher / certificate | code signed by this vendor may run | scales across versions, the standard choice | breaks when a vendor stops signing, or on self-written scripts |
| Hash | this exact binary may run | exact, unforgeable | useless after every update; unmanageable without automation |
| Path | anything in this folder may run | simple | users and attackers can write to many folders, so pick the folder carefully |
It stops ransomware (the encryptor is not on the list), it stops unapproved software, and it defeats whole families of attacks that rely on writing a payload to disk. The honest cost is management: every legitimate business application must be added, every update path accommodated, and someone must own the queue of "I need this tool" requests. That is why allowlisting is usually deployed on servers and standardised workstations first, and only later on machines belonging to developers and administrators. On Windows the built-in options are AppLocker and Windows Defender Application Control; on Linux, fapolicyd on RHEL-family systems, and the kernel-level mandatory access controls covered in Lesson 17.
[!WARNING] Turn allowlisting on in audit mode first, collect the events, review what would have been blocked, and only then enforce. Enforcing on day one on a machine nobody modelled will lock out the user, and a control that gets switched off after one incident is worse than no control, because it was paid for.
Privilege control
Removing local administrator rights is free and removes a large share of real-world impact. The reason is mechanical: most commodity malware needs elevation to disable defences, install persistence and dump credentials.
| Practice | Why it matters |
|---|---|
| No routine local admin for users | most malware cannot elevate, so most malware cannot persist |
| A separate admin account, used only for admin work | if the everyday account is phished, it is not privileged; if the admin account is not used for email, it is much harder to phish |
| Never admin on the account you read email with | this one rule breaks the most common privilege-escalation chain |
| Unique local admin password per machine | stops one stolen local hash from opening every workstation (see Lesson 13) |
| Time-boxed elevation where the platform offers it | admin for an hour, not forever |
What breaks, so you can plan for it: legacy line-of-business software that writes to Program Files; drivers and printers; developers needing debuggers; anyone whose job is genuinely administration. The answer is never "give everyone admin" — it is a documented exception, a separate account, or an application packaged properly. On Windows, check net localgroup Administrators; on Linux, membership of sudo and wheel groups, and the sudoers file.
Patch management
| Tension | The workable answer |
|---|---|
| Patching breaks things | ringed rollout: test group, then a small pilot, then everything; a defined but short deferral window |
| Nobody has time | automate the deployment, then manage only the exceptions by name |
| Third-party apps are forgotten | patch them or remove them; most exploited software is not the operating system |
| Something is end of life | it cannot be patched, so it must be isolated, restricted or retired — an unpatched OS on the network is a decision, and it needs an owner |
Windows security updates land on the second Tuesday of the month, which gives you a natural cadence and a natural spike of exploitation attempts in the following days. Prioritise what is actually being exploited over raw severity scores: the CISA Known Exploited Vulnerabilities catalogue and the EPSS score are both free and both better than a severity number alone.
Encryption, host firewall and the mobile edge
| Control | What it does | The detail most people miss |
|---|---|---|
| Full-disk encryption | a stolen laptop is a lost device, not a data breach | BitLocker with a TPM, LUKS on Linux, FileVault on macOS; escrow the recovery key centrally or a disk failure becomes a business failure |
| Host firewall | filters traffic per machine, per application | Windows Defender Firewall, ufw/nftables/firewalld on Linux; default-deny inbound, allow only the ports the host needs |
| Device hardening | removes the easy attack surface | the baseline in Lesson 17: disable unused services, remove legacy protocols, restrict removable media |
| Mobile and BYOD | laptops and phones outside your building | enrolment in an MDM, work-profile containerisation so corporate data sits apart from personal apps, enforced screen lock and encryption, and remote wipe for the corporate container |
Managed mobile is not optional once anyone reads email on a phone. The minimum viable position is enrolment, a PIN, encryption, and the ability to wipe corporate data remotely without wiping the device. Conditional access in Lesson 20 is how you turn "device is enrolled" into a requirement rather than a hope.
Response actions, agent health and honest limits
The reason an endpoint agent is worth its licence and its CPU cost is not only detection: it is that it gives you buttons during an incident.
| Action | What it does | When to use it |
|---|---|---|
| Isolate host | cuts the machine off from the network while leaving the agent's channel open | first action on a suspected compromise — it stops spread, keeps the evidence and keeps you in control |
| Kill process | terminates a running malicious process | useful, but the attacker may have persistence elsewhere; never the only action |
| Quarantine file | moves a known-bad file to a safe store | standard malware containment |
| Collect triage artefact | packages running processes, autoruns, network state, selected logs | hands the analyst a starting point instead of a remote shell and hope |
| Live shell | interactive access for investigation | powerful; requires the policy and the audit trail to go with it |
Isolation is the single most valuable instant action in an incident. It is reversible, it preserves memory and disk, and it converts an unfolding problem into a static one you can investigate at your own pace. Compare that with powering the machine off, which destroys memory and can destroy logs, and with leaving it online, which lets the attacker keep working.
Two things that are usually forgotten:
- Agent health is a control. An endpoint whose agent stopped reporting is a blind spot, and many actors make disabling the agent an early step. Monitor the console for hosts that have gone silent, agents out of date, and real-time protection switched off. An endpoint you cannot see is worse than one you never had, because you believe it is covered.
- Know the limits. EDR needs tuning or it becomes noise; an attacker with kernel-level privilege can blind an agent; behavioural detection produces false positives on legitimate admin tooling; and none of it is a backup. Endpoint security reduces the frequency and the depth of compromise — it does not let you skip Lesson 21.
When choosing open-source tooling, ask three questions: does it cover the telemetry in the table above, does it alert centrally and not only locally, and can one person run it? Candidates well worth evaluating are Wazuh for host-based monitoring and detection with an agent, Sysmon plus auditd as the raw telemetry layer, Velociraptor for collection and triage across many hosts, fapolicyd or AppLocker/WDAC for allowlisting, and the OS host firewall you already own.
Attack it / Defend it
| The attack | How it works | The control that stops it |
|---|---|---|
| Phishing payload executed | a user opens a document that spawns a shell | EDR behavioural detection on the parent–child chain, allowlisting, attachment sandboxing |
| Living off the land | uses built-in tools (powershell.exe, certutil.exe, wmic.exe) so no malware is dropped |
behaviour-based rules on command lines and parents, not signatures |
| Local privilege escalation | exploits an unpatched local service to become SYSTEM | patch cadence, no local admin for users, least privilege |
| Credential dumping | reads LSASS or /etc/shadow to steal credentials |
EDR process-access alerting, credential protection, separate admin identity |
| Persistence via Run key or service | survives reboot without user action | allowlisting, telemetry on registry and service creation, alerting on new autoruns |
| Ransomware encryption | encrypts documents as fast as the disk allows | allowlisting, offline backups (Lesson 21), isolation on first detection |
| Agent tampering | disables or uninstalls the security agent | tamper protection, central health monitoring, alert on the agent stopping |
| USB-borne malware | autorun or a user-launched binary from removable media | device control policy, allowlisting, telemetry on USB insertion |
| Stolen unencrypted laptop | the disk is read offline, no exploitation needed | full-disk encryption with centrally escrowed keys |
| Unpatched internet-facing app | public exploit against a known flaw | patch by exploitation status, not by severity score |
Key takeaways
- The endpoint is where data lives and where intrusions land — network controls limit the blast radius, endpoint controls decide whether there is a blast at all.
- Signature-only defence is defeated by anything new. Behavioural telemetry, not file matching, is what detects the malware written for you.
- Six telemetry fields carry most investigations: process creation with command line, parent process, file write, registry change, network connection, executing user.
- Allowlisting is the strongest single control and the one with the highest management cost — deploy it in audit mode, on the machines that matter first.
- Isolation beats shutdown. The first valuable action in an incident is to cut a host off while leaving it alive and observable.
- An agent that has silently stopped reporting is a blind spot, and it is a monitorable event in its own right.
Check yourself
- A user opens an invoice document and the endpoint agent alerts on
WINWORD.EXEspawningcmd.exe. Why is that relationship suspicious when neither file is malicious? - Why does an EDR agent detect malware that has never been seen by any vendor, when a signature-based antivirus cannot?
- Your organisation wants to remove local administrator rights from all staff. Name two things that will break and the two ways to handle each.
- You suspect a workstation is compromised. Why is isolating the host better than powering it off before you investigate?
- Name three endpoint telemetry fields an analyst would need to reconstruct how an intrusion started, and what each one tells them.