kompozit · edukator režim · za predavanje i PDF
EDR
Odbrana u centru, pretnje koje suzbija levo, tehnike koje neutrališe desno. Ispod kartice — profil odbrane: šta presreće i koliko košta.
← Threats it reduces19
defense · № 003 · endpoints
EDR
EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
→ profil odbrane · šta presreće i koliko košta
tip kontroleDetektivna + responzivna
domenZaštita krajnjih tačaka i elektronske pošte
napor ↔ uticajSrednji napor / Visok uticaj
alat · standardCrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, MITRE ATT&CK
← Techniques it neutralizes22
Techniques it neutralizes. Klik vodi na stranicu pojma.
- Exploitation→
- Data Exfiltration→
- Malware Delivery→
- Lateral Movement→
- Command & Control→
- Privilege Escalation→
- Impair Defenses→
- Persistence→
- Automation & Scripting→
- Encrypted C2 Channels→
- Living off the Land→
- Process Injection→
- Payload Obfuscation→
- In-Memory Execution→
- DLL Sideloading→
- Supply Chain Compromise→
- Data Destruction→
- Drive-by Download→
- Indicator Removal→
- Timestomping→
- Rootkit Installation→
- Watering Hole→