Investigating from the Endpoint Across Your Environment with Elastic Security XDR

MITRE Techniques

• [T1059 ] Command and Scripting Interpreter – Endpoint telemetry captures process execution enabling detection of malicious commands and scripts (‘captures system events including process execution, file changes, network connections, and related artifacts.’)
• [T1055 ] Process Injection – Protections and detections target fileless techniques that often use in-memory injection to evade disk-based detection (‘Multiple detection layers protect against malware, ransomware, fileless techniques, and other malicious behaviors…’)
• [T1547 ] Boot or Logon Autostart Execution – Forensic queries and telemetry surface startup items and persistence mechanisms attackers use to maintain access (‘scheduled tasks, startup items, and persistence mechanisms’)
• [T1053 ] Scheduled Task/Job – Investigations examine scheduled tasks as a common persistence or execution vector (‘scheduled tasks, startup items, and persistence mechanisms’)
• [T1078 ] Valid Accounts – Correlation of identity events and endpoint activity helps reveal use of compromised credentials across users and services (‘Credentials may be compromised, workloads modified, or activity spread across cloud services and infrastructure.’)
• [T1021 ] Remote Services – Correlating network, cloud, and endpoint telemetry exposes lateral movement and remote execution across endpoints and workloads (‘activity moves across users, systems, and infrastructure’ and ‘coordinated activity across endpoints, identities, workloads, and cloud services within minutes.’)
• [T1052 ] Exfiltration Over Physical Medium – Device Control and removable-media policies are used to prevent USB-based exfiltration and enforce approved device lists (‘removable media usage or potential USB-based exfiltration’ and ‘automatically block USB devices’).