Endpoint protection basics: antivirus and EDR
You learn with examples how endpoint protection works, from signature-based antivirus to behaviour-based EDR, what it sees and what it misses.
Level 101 · 14 lessons · 15 practice labs
Lessons
How antivirus works
- What an endpoint is and why it is the first target
- Signatures and hashes: recognising known bad
- Heuristic scanning and sandboxing
- Testing protection safely with the EICAR test file
- Short task: find at which stage the test file is caught
EDR
- What EDR is: telemetry, detection, response
- Process trees: which program started what
- Behavioural detection: catching an attack with no signature
- Response actions: isolation, killing a process, quarantine
- Short task: find the first bad step in a suspicious process tree
Limits and operations
- Why protection gets bypassed: fileless attacks and legitimate tools
- The risk of exclusions: misconfigured allow-listing
- From an EDR alert to a case: the first ten minutes
- Capstone: investigate an endpoint alert and make a call
Practice labs
- Look up this file’s hash in the known-bad list: Compute the SHA-256 hash of three suspicious files, compare them with the given threat list and find the match.
- Find the stage at which the EICAR file is caught: Drop the test file to disk in different ways and extract the moment and method of detection from the scan records.
- Spot the file whose hash is clean but whose behaviour is bad: Compare sandbox reports and pick, with reasons, the sample with no known signature that behaves suspiciously.
- Find the first bad step in a process tree: Build the process tree from EDR telemetry and mark the first unusual parent–child link.
- Follow the chain that starts in Word to its end: List the processes spawned from WINWORD in the JSON telemetry and find which file was downloaded at the end.
- Reconstruct an attack done with legitimate tools from the tree: Find the unusual use of signed Windows tools in the tree and map each step to an ATT&CK technique.
- Find the one suspicious command line in noisy telemetry: Filter hundreds of process records by command line and find the encoded PowerShell call.
- Choose the right response action for this alert: Read the alert details and pick isolation, killing the process or quarantine, with the reason.
- Find the risky exclusion rule and narrow it: Review the exclusions in the EDR policy, find the rule covering the whole Temp folder and reduce it to a single file.
- Make the first ten minutes’ call on an endpoint alert: Combine telemetry, user and asset information, decide whether the alert is real and write the note with evidence.
- Read the record of a quarantined file: Extract the file’s path, hash, user and time from the quarantine record.
- Notice bypassed protection from a gap in telemetry: Find when an endpoint suddenly stopped sending telemetry and catch the protection-disabling command just before it.
- Compare how three detection methods judge the same file: Lay the signature, heuristic and behaviour records for four samples side by side, tabulate what each method missed and justify which verdict you trust.
- Test three protection layers with the harmless test file: Try the EICAR file at download, archive extraction and execution and record which layer acts at which stage.
- Expose an excluded folder with the test file: Place the test file in different folders to find the path that is not scanned, remove the unneeded exclusion and prove it by retesting.
About this course
You learn with examples how endpoint protection works, from signature-based antivirus to behaviour-based EDR, what it sees and what it misses.
What you will learn
- How antivirus works
- EDR
- Limits and operations
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.