🛡️ TryHackMe — Introduction to EDR | Learning Guide
Platform: TryHackMe Room: Introduction to EDR Path: SOC Level 1 → Core SOC Solutions Estimated Time: 60 Minutes Status: Completed ✅
Spoiler-Free Learning Guide: This article contains no TryHackMe flags, dashboard-specific answers, malware paths, URLs, or direct task solutions. It focuses on EDR architecture, telemetry, detection, response, and the investigation methodology I learned while completing the room.
Introduction
After learning about SIEM, alert triage, and SOC reporting, I moved on to another core defensive technology used inside a Security Operations Center:
EDR
EDR stands for:
Endpoint Detection and Response
An endpoint can be:
Windows workstation
Linux system
Mac
Laptop
Desktop
Server
Traditional network security controls cannot always provide detailed visibility into everything happening inside these devices—especially with remote work and endpoints operating outside the corporate perimeter.
EDR addresses this by continuously monitoring endpoints, collecting detailed activity, detecting suspicious behavior, and giving analysts response capabilities from a centralized console. TryHackMe structures this room around EDR fundamentals, antivirus comparison, architecture, telemetry, detection/response capabilities, and a simulated EDR investigation. (TryHackMe)
The room follows this learning path:
Introduction
↓
What is an EDR?
↓
Beyond the Antivirus
↓
How an EDR Works
↓
EDR Telemetry
↓
Detection & Response
↓
Investigate an EDR Alert
↓
Conclusion
Task 1 — Introduction
The first task introduces EDR from a SOC analyst's perspective.
The goal is not simply to install security software on a computer.
The goal is to answer questions such as:
What executed?
Who executed it?
Which process launched it?
Which files changed?
Which registry keys changed?
Where did the system connect?
What happened before and after the detection?
This deep endpoint visibility is what makes EDR especially useful during investigations.
TryHackMe's learning objectives include understanding EDR architecture, comparing EDR with antivirus, examining collected telemetry, understanding detection and response capabilities, and investigating a realistic alert. (TryHackMe)
EDR in a SOC
A simplified SOC architecture might look like:
Windows ────┐
Linux ──────┤
Laptops ────┤
Servers ────┤
↓
EDR
↓
Endpoint Visibility
↓
SOC Analyst
EDR focuses heavily on what happens on endpoints.
Other tools protect other areas:
Firewall → Network traffic
Email Security → Email threats
SIEM → Centralized security data
EDR → Endpoint activity
These technologies complement each other rather than replacing one another. (TryHackMe)
🛠️ Hands-On / Tools — Task 1
Tools Used
TryHackMe Room
Simulated EDR concepts
SOC investigation workflow
Endpoint security terminology
This task was mainly conceptual.
My initial mental model became:
Endpoint
↓
EDR Agent
↓
Collect Activity
↓
Central EDR Console
↓
Detect
↓
Investigate
↓
Respond
Task 2 — What Is an EDR?
This task explains why EDR exists.
Organizations once relied heavily on protections located around their internal network.
But endpoints now operate from:
Corporate offices
Homes
Hotels
Public networks
Remote locations
Cloud-connected environments
That makes endpoint-level protection extremely important.
TryHackMe defines EDR as a security solution that provides deep endpoint protection and continuously monitors devices regardless of where they are located. (TryHackMe)
The Three Pillars of EDR
The room presents three core EDR capabilities:
Visibility
Detection
Response
These are the easiest way for me to remember what an EDR actually does.
1. Visibility 👁️
EDR collects detailed information from endpoints.
Examples include:
Process activity
File activity
Folder changes
Registry changes
User actions
Network connections
Command execution
Instead of seeing only:
"Malware detected"
an analyst may be able to reconstruct:
User opened document
↓
Document launched child process
↓
Child process launched PowerShell
↓
PowerShell downloaded file
↓
File executed
↓
Process connected externally
That is much more useful for investigation.
Process Trees
One especially important EDR feature is the:
Process Tree
Processes often have relationships.
For example:
explorer.exe
↓
winword.exe
↓
powershell.exe
↓
payload.exe
The EDR can show:
Parent Process
↓
Child Process
↓
Grandchild Process
This makes unusual relationships easier to identify.
TryHackMe uses a graphical process tree to demonstrate how EDR lets analysts view spawned processes and associated network, registry, and file activity. (TryHackMe)
2. Detection 🔍
EDR does more than compare files against known malware signatures.
Detection mechanisms can include:
Signature matching
Behavior analysis
Machine learning
IOC matching
Anomaly detection
For example:
Microsoft Word
↓
spawns
↓
PowerShell
may deserve attention because that parent-child relationship can be unusual.
3. Response 🛑
Detection alone is not enough.
EDR can also let analysts take actions such as:
Isolate host
Terminate process
Quarantine file
Remotely investigate endpoint
Collect artifacts
TryHackMe emphasizes that analysts can perform many of these actions directly from the centralized EDR console. (TryHackMe)
Common EDR Products
The room gives examples including:
CrowdStrike Falcon
Microsoft Defender for Endpoint
SentinelOne
Symantec EDR
Different products have different interfaces and features, but their overall architecture and goals are similar. (TryHackMe)
🛠️ Hands-On / Tools — Task 2
Concepts Practiced
EDR console
Endpoint visibility
Process trees
Detections
Response actions
My revision model:
EDR
|
┌───────┼───────┐
| | |
View Detect Respond
Task 3 — Beyond the Antivirus
This was one of the most useful conceptual tasks.
The question is:
If we already have antivirus, why do we need EDR?
Both protect endpoints, but they provide different levels of visibility and detection.
Traditional Antivirus
Traditional antivirus has historically relied strongly on:
Known malware signatures
Known malicious files
Known patterns
Conceptually:
File arrives
↓
Compare against known signatures
↓
Match?
/ \
Yes No
| |
Block Allow
The problem appears when the attack is:
New
Obfuscated
Fileless
Living off the land
Behavior-based
EDR
EDR continuously monitors what happens after execution as well.
Instead of only asking:
Is this file known to be malicious?
EDR may also ask:
What is this process doing?
What spawned it?
What commands did it run?
Which files did it modify?
Where did it connect?
Does this behavior look normal?
Airport Analogy
TryHackMe uses a useful analogy.
Think of the endpoint as an:
Airport
Traditional antivirus behaves somewhat like:
Immigration check
It compares people against known information.
EDR behaves more like:
Security officers
+
Cameras
+
Continuous monitoring
Even if someone passes the first security check, suspicious behavior inside the airport can still be detected. (TryHackMe)
Example Attack Chain
A simplified attack might look like:
Phishing document
↓
User opens document
↓
Macro executes
↓
PowerShell launches
↓
Payload downloaded
↓
Process injection
↓
External connection
An antivirus might miss parts of this if individual files or actions do not match known signatures.
EDR can potentially observe the entire chain of behavior, including unusual process relationships, obfuscated commands, injection, and network activity from the endpoint. (TryHackMe)
Antivirus vs EDR
| Antivirus | EDR |
|---|---|
| Strong focus on prevention | Prevention + detection + investigation + response |
| Often signature focused | Signature + behavior + anomaly detection |
| Limited investigation context | Detailed endpoint telemetry |
| Detects known malicious files well | Can detect advanced behavioral chains |
| Limited response workflow | Analyst-driven response capabilities |
| Primarily endpoint protection | Endpoint monitoring, detection, investigation and response |
Modern antivirus products can be much more capable than older signature-only tools, but the main learning point remains that EDR provides deeper visibility and response functionality. (TryHackMe)
🛠️ Hands-On / Methodology — Task 3
This task was mainly about reasoning through an attack chain.
My workflow was:
Look at individual action
↓
Looks harmless?
↓
Check parent process
↓
Check next action
↓
Build full chain
↓
Reassess behavior
Key takeaway:
One event may look legitimate. The complete sequence may not.
Task 4 — How an EDR Works
Now the room explains the architecture behind EDR.
At a high level, there are two important pieces:
EDR Agent
+
EDR Console
EDR Agent / Sensor
The EDR agent is installed on endpoints.
Think of it as the:
Eyes and ears
of the EDR.
It monitors local activity such as:
Processes
Commands
Files
Registry
Network connections
User actions
and sends relevant information to the centralized EDR infrastructure. (TryHackMe)
Central EDR Console
The centralized console receives endpoint telemetry.
Conceptually:
Endpoint A ───┐
Endpoint B ───┤
Endpoint C ───┤
Server D ─────┤
↓
EDR Console
↓
Correlation & Analysis
↓
Detection
The platform may apply:
Detection rules
Threat intelligence
Behavioral analysis
Machine learning
Correlation
to identify suspicious activity. (TryHackMe)
After a Detection
The workflow becomes:
EDR detection
↓
Severity assigned
↓
SOC analyst reviews
↓
Investigate activity
↓
False Positive?
or
True Positive?
↓
Take appropriate action
Typical severity levels may include:
Critical
High
Medium
Low
Informational
EDR and SIEM Together
EDR is powerful, but it does not contain every security data source.
A SOC may also use:
Firewall
DLP
Email Gateway
IAM
Proxy
Network security tools
Their data may be integrated into:
SIEM
giving analysts a broader investigation platform.
So:
EDR
↓
Deep endpoint context
SIEM
↓
Broad cross-environment context
They complement each other. (TryHackMe)
🛠️ Hands-On / Tools — Task 4
Tools / Concepts Used
EDR Agent
EDR Console
Threat Intelligence
Alert Severity
SOC workflow
SIEM integration
My architecture diagram:
ENDPOINT
|
EDR Agent
|
v
TELEMETRY
|
v
EDR CONSOLE
|
v
ANALYTICS
|
v
DETECTION
|
v
SOC ANALYST
Task 5 — EDR Telemetry
This task focuses on one of the most important EDR concepts:
Telemetry
Telemetry is the detailed endpoint data collected by the EDR agent.
TryHackMe describes it as effectively the endpoint's black box, containing the information needed to detect threats and reconstruct activity during investigations. (TryHackMe)
1. Process Execution and Termination
EDR may record:
Process name
Parent process
Child process
Start time
End time
Execution path
This is useful for identifying suspicious chains.
Example:
winword.exe
↓
powershell.exe
↓
unknown.exe
2. Network Connections
The endpoint's network activity can also be monitored.
This may reveal:
Remote IP
Remote domain
Port
Process creating connection
Connection time
Security uses include identifying:
C2 communication
Unusual ports
Data exfiltration
Lateral movement
3. Command-Line Activity
EDR can capture commands executed through tools such as:
CMD
PowerShell
This is extremely useful because attackers often use legitimate built-in utilities.
Example:
powershell.exe
↓
encoded / obfuscated command
The binary itself is legitimate.
The command may be malicious.
4. File and Folder Modifications
EDR can monitor:
Files created
Files modified
Files deleted
Files renamed
Directories changed
This helps detect behavior such as:
Malware dropping payloads
Ransomware modifying files
Data staging
Suspicious file creation
5. Registry Modifications
Windows Registry changes can reveal:
Persistence
Configuration changes
Startup modifications
Security-setting changes
EDR can capture many of these modifications and link them to the process responsible.
Why Telemetry Matters
Individual actions may look legitimate.
For example:
PowerShell executed
is not automatically malicious.
But:
Document opens
↓
PowerShell launches
↓
PowerShell downloads executable
↓
Executable modifies registry
↓
Executable contacts unknown server
is much more suspicious.
Telemetry lets analysts reconstruct this chain. (TryHackMe)
🛠️ Hands-On / Tools — Task 5
Telemetry I Focused On
Process tree
Command line
File path
Registry changes
Network connections
User
Hostname
Timestamps
My investigation order:
PROCESS
↓
PARENT
↓
COMMAND
↓
FILE
↓
NETWORK
↓
REGISTRY
↓
TIMELINE
Optional Local Practice
Outside the TryHackMe room, similar Windows information can be explored safely using:
Get-Process
and:
Get-NetTCPConnection
These are not replacements for EDR telemetry, but they help build intuition about the endpoint activity an EDR observes.
Task 6 — Detection and Response Capabilities
This task goes deeper into how EDR identifies advanced threats.
Detection Techniques
1. Behavioral Detection
Instead of asking:
Is this file known malware?
behavioral detection asks:
Is this behavior suspicious?
Example:
winword.exe
↓
powershell.exe
This parent-child relationship may be unusual enough to warrant investigation.
2. Anomaly Detection
Over time, an EDR can understand normal endpoint behavior.
If something deviates strongly from that baseline:
Normal Behavior
↓
Unexpected Change
↓
Anomaly
↓
Detection
Anomalies can generate false positives, so analyst context remains important.
3. IOC Matching
IOC stands for:
Indicator of Compromise
Examples include:
Malicious file hash
IP address
Domain
URL
The EDR can compare endpoint activity with threat-intelligence feeds.
Observed hash
↓
Threat Intelligence
↓
Known malicious?
If yes, the activity can be flagged quickly.
4. MITRE ATT&CK Mapping
EDR detections may be mapped to:
MITRE ATT&CK
For example:
Activity:
Scheduled task created
Tactic:
Persistence
Technique:
Scheduled Task / Job
This gives the analyst additional context about where the activity fits within an attack lifecycle. (TryHackMe)
5. Machine Learning
Modern EDR systems may use machine learning to identify complex patterns.
This becomes helpful when:
Individual Activity A → Not obviously malicious
Individual Activity B → Not obviously malicious
Individual Activity C → Not obviously malicious
A + B + C together → Suspicious pattern
This can help identify multi-stage or fileless attacks.
Response Capabilities
After detection comes:
Response
TryHackMe covers several important actions. (TryHackMe)
Isolate Host
Compromised Endpoint
↓
Network Isolation
↓
Lateral Movement Reduced
This can be extremely useful when a threat is actively spreading.
Terminate Process
Sometimes isolating the whole host would disrupt important business activity.
Instead:
Malicious Process
↓
Terminate
may be enough.
Analysts need to be careful because terminating legitimate critical processes can also disrupt systems.
Quarantine File
A malicious file can be moved to an isolated state where it cannot execute normally.
Suspicious File
↓
Quarantine
↓
Review / Remove / Restore
Remote Access
EDR platforms may allow security analysts to remotely interact with an endpoint.
This can be used for:
Additional investigation
Custom commands
Collecting evidence
Running scripts
Taking response actions
Artifact Collection
Analysts may need to collect:
Memory dumps
Event logs
Registry hives
Specific files
Folder contents
for deeper forensic investigation.
🛠️ Hands-On / Workflow — Task 6
My response decision tree became:
TRUE POSITIVE
↓
How serious?
↓
Is attack active?
↓
Contain
↓
┌─────────────┬──────────────┐
| | |
Isolate Terminate Quarantine
Host Process File
\ | /
\ | /
└─────────┴───────────┘
↓
Collect Evidence
Task 7 — Investigate an Alert on EDR
This was the practical part of the room.
TryHackMe provides a simulated EDR dashboard with several detections.
The task is to investigate the detections using the visibility available inside the EDR. The exercise intentionally focuses on understanding detection context rather than performing response actions. (TryHackMe)
My Investigation Workflow
Instead of searching directly for the question answer, I used a repeatable investigation method.
Open Detection
↓
Identify Host
↓
Identify User
↓
Inspect Process Tree
↓
Find Suspicious Parent / Child
↓
Read Command Line
↓
Inspect File Activity
↓
Inspect Network Activity
↓
Check Threat Intelligence
↓
Build Attack Timeline
Step 1 — Identify the Endpoint
First:
Which machine triggered the alert?
The hostname is important because several alerts may exist for different systems.
Step 2 — Look at the Process Tree
I examine:
Parent
↓
Child
↓
Grandchild
and ask:
Does this relationship make sense?
For example:
User application
↓
Command shell
↓
Downloader
may deserve attention.
Step 3 — Inspect Command-Line Arguments
The executable name alone often does not reveal enough.
For example:
cmd.exe
is legitimate.
So is:
powershell.exe
But what matters is:
What command did it run?
Command-line telemetry can reveal:
Download commands
Encoded commands
Suspicious scripts
File paths
Remote URLs
Step 4 — Inspect File Activity
Look for:
Downloaded files
Created executables
Temporary paths
Unexpected directories
Renamed files
Absolute paths are especially useful because they tell us where the artifact actually exists.
Step 5 — Inspect Network Activity
Questions include:
Which process made the connection?
Which domain / URL?
Which remote IP?
Which port?
Was data uploaded?
This can reveal:
C2
Payload download
Data exfiltration
Step 6 — Check Threat Intelligence Context
Some EDR platforms enrich detections with threat-intelligence information.
This can help answer:
Is the file known?
Has this hash been seen before?
How is it classified?
Is it associated with malware?
But threat intelligence should be combined with behavior rather than used blindly.
Step 7 — Reconstruct the Timeline
The final goal is not simply to answer:
What filename?
The goal is to understand:
What happened from beginning to end?
For example:
Initial process
↓
Command execution
↓
Download
↓
Payload execution
↓
Network activity
↓
Potential exfiltration
That is the real value of EDR visibility.
🛠️ Hands-On / Tools — Task 7
Tools Used
TryHackMe simulated EDR
Detection dashboard
Process tree
Command-line telemetry
File telemetry
Network telemetry
Threat-intelligence enrichment
I intentionally excluded:
❌ Downloader-tool answer
❌ Malware path
❌ Suspicious executable path
❌ Exfiltration URL
❌ Threat-intelligence classification answer
so other learners can investigate the detections themselves.
Task 8 — Conclusion
By the end of the room, EDR no longer felt like:
"Antivirus with more features"
Instead, I now understand it as:
ENDPOINT
|
v
EDR AGENT
|
v
TELEMETRY
|
┌────────────┼─────────────┐
| | |
Processes Files Network
| Registry Commands
└────────────┼─────────────┘
|
v
EDR CONSOLE
|
v
DETECTION
|
┌───────────┼───────────┐
| | |
Behavior IOC Anomaly / ML
| | |
└───────────┼───────────┘
|
v
SOC ANALYST
|
v
INVESTIGATION
|
v
RESPONSE
TryHackMe closes the room by reinforcing EDR architecture, telemetry, advanced detection mechanisms, response capabilities, and practical alert investigation. (TryHackMe)
EDR Telemetry Cheat Sheet
| Telemetry | What It Helps Identify |
|---|---|
| Process execution | Suspicious parent-child relationships |
| Command line | Malicious or obfuscated commands |
| Network connections | C2, lateral movement, exfiltration |
| File changes | Malware drops, ransomware, staging |
| Registry changes | Persistence and configuration changes |
| User activity | Who performed the action |
| Process tree | Complete execution chain |
| Timestamps | Reconstructing the attack timeline |
Detection Cheat Sheet
| Detection Type | Main Idea |
|---|---|
| Signature | Matches known threat |
| Behavioral | Detects suspicious actions |
| Anomaly | Detects deviation from baseline |
| IOC Matching | Matches known indicators |
| MITRE Mapping | Maps activity to attack tactic/technique |
| Machine Learning | Identifies complex behavioral patterns |
Response Cheat Sheet
| Response | Purpose |
|---|---|
| Isolate Host | Contain endpoint |
| Terminate Process | Stop malicious execution |
| Quarantine File | Prevent suspicious file execution |
| Remote Access | Investigate/respond directly |
| Collect Artifacts | Support deeper forensic analysis |
Key Lessons Learned
1. EDR Is About Visibility as Much as Detection
A detection saying:
Malware found
is useful.
But:
Process tree
+
Command line
+
Files
+
Registry
+
Network
+
Timeline
is far more valuable for investigation.
2. Context Can Reveal What Signatures Miss
A legitimate process can perform malicious activity.
PowerShell
is not malware.
But:
Document
↓
PowerShell
↓
Obfuscated downloader
may be suspicious.
3. Telemetry Tells the Attack Story
Rather than viewing isolated alerts:
Event A
Event B
Event C
EDR can help us see:
A
↓
B
↓
C
↓
Attack Chain
4. Antivirus and EDR Are Not the Same
A useful mental model is:
Antivirus
↓
Primarily prevention/detection
EDR
↓
Visibility
+
Detection
+
Investigation
+
Response
5. Response Must Be Context-Aware
Immediately isolating every host would be a poor strategy.
A production server may be business-critical.
Sometimes:
Terminate process
is better than:
Isolate entire host
Response requires both security judgment and business awareness.
6. Process Trees Are Extremely Valuable
Whenever I investigate an EDR alert, one of my first questions is now:
Who spawned whom?
A suspicious child process can completely change the meaning of an otherwise legitimate application.
My Final EDR Investigation Model
DETECTION
|
v
HOST
|
v
PROCESS TREE
|
┌─────────┼─────────┐
| | |
Parent Child Command
| | |
└─────────┼─────────┘
|
FILE ACTIVITY
|
v
NETWORK ACTIVITY
|
v
REGISTRY / USER DATA
|
v
THREAT INTELLIGENCE
|
v
BUILD TIMELINE
|
┌───────┴───────┐
| |
BENIGN MALICIOUS
| |
CLOSE RESPOND
Ethical Learning Note
This article is a learning guide rather than an answer dump.
I included:
✅ EDR architecture
✅ EDR vs antivirus
✅ Telemetry concepts
✅ Detection techniques
✅ Response capabilities
✅ Alert investigation workflow
✅ Generic examples
while intentionally excluding:
❌ TryHackMe answers
❌ Malware paths
❌ Exfiltration URL
❌ Threat-intelligence answer
❌ Dashboard-specific values
❌ Direct task submissions
The goal is to document the methodology while leaving the actual EDR investigation exercise for other learners to solve themselves.
Resources
🌐 TryHackMe Room: Introduction to EDR
👨💻 TryHackMe Profile: sunnysharma11200
💻 GitHub Repository: tryhackme-writeups
✍️ Hashnode Blog: cybersecurity-learning.hashnode.dev
Connect with Me
TryHackMe: sunnysharma11200
GitHub: SunnySharma04
Hashnode: cybersecurity-learning
LinkedIn: Sunny Sharma
Happy Learning! 🚀
