Lesson 4 of 15 · 7 min read
Endpoint and Network Telemetry for Detection
Endpoint telemetry (process creation with command lines and parents, network connections per process, file and persistence changes, authentication and module loads) shows what ran and why. Network telemetry (flow records, DNS, proxy logs and TLS metadata) shows who talked to whom, how much and how regularly, even when payloads are encrypted. Sensors collect these through kernel callbacks and event tracing on Windows, eBPF and audit on Linux, and Endpoint Security on macOS. Attackers try to blind sensors and blend into allowed channels, so telemetry must be shipped off-host quickly, watched for silence, enriched and correlated.
free sign-in, no card required
Practise it as an interviewer asks it
An EDR alert says a Word document spawned PowerShell with an encoded command on a finance laptop. How do you triage it?What endpoint telemetry matters most for detection and investigation on Windows and Linux, and how is it collected?With most traffic encrypted, what can network monitoring still detect, and how would you design it?How does malware work end to end on a desktop or server, from delivery to impact, and where can defenders see and stop each stage?Where does malware hide to survive a reboot on Windows, Linux and macOS, and how do defenders find and prevent persistence?Attackers are using stolen cloud credentials to run LLMs on your account. How do you detect and respond to LLMjacking?