# 🛡️ TryHackMe — Introduction to EDR | Learning Guide

> **Spoiler-Free Learning Guide:** This article contains **no TryHackMe flags, dashboard-specific answers, malware paths, URLs, or direct task solutions**. It focuses on EDR architecture, telemetry, detection, response, and the investigation methodology I learned while completing the room.

## Introduction

After learning about **SIEM, alert triage, and SOC reporting**, I moved on to another core defensive technology used inside a Security Operations Center:

# EDR

EDR stands for:

```text
Endpoint Detection and Response
```

An endpoint can be:

```text
Windows workstation
Linux system
Mac
Laptop
Desktop
Server
```

Traditional network security controls cannot always provide detailed visibility into everything happening **inside** these devices—especially with remote work and endpoints operating outside the corporate perimeter.

EDR addresses this by continuously monitoring endpoints, collecting detailed activity, detecting suspicious behavior, and giving analysts response capabilities from a centralized console. TryHackMe structures this room around EDR fundamentals, antivirus comparison, architecture, telemetry, detection/response capabilities, and a simulated EDR investigation. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

The room follows this learning path:

```text
Introduction
      ↓
What is an EDR?
      ↓
Beyond the Antivirus
      ↓
How an EDR Works
      ↓
EDR Telemetry
      ↓
Detection & Response
      ↓
Investigate an EDR Alert
      ↓
Conclusion
```

* * *

# Task 1 — Introduction

The first task introduces EDR from a **SOC analyst's perspective**.

The goal is not simply to install security software on a computer.

The goal is to answer questions such as:

```text
What executed?

Who executed it?

Which process launched it?

Which files changed?

Which registry keys changed?

Where did the system connect?

What happened before and after the detection?
```

This deep endpoint visibility is what makes EDR especially useful during investigations.

TryHackMe's learning objectives include understanding EDR architecture, comparing EDR with antivirus, examining collected telemetry, understanding detection and response capabilities, and investigating a realistic alert. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## EDR in a SOC

A simplified SOC architecture might look like:

```text
Windows ────┐
Linux ──────┤
Laptops ────┤
Servers ────┤
            ↓
          EDR
            ↓
     Endpoint Visibility
            ↓
        SOC Analyst
```

EDR focuses heavily on what happens **on endpoints**.

Other tools protect other areas:

```text
Firewall → Network traffic

Email Security → Email threats

SIEM → Centralized security data

EDR → Endpoint activity
```

These technologies complement each other rather than replacing one another. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 🛠️ Hands-On / Tools — Task 1

### Tools Used

```text
TryHackMe Room
Simulated EDR concepts
SOC investigation workflow
Endpoint security terminology
```

This task was mainly conceptual.

My initial mental model became:

```text
Endpoint
   ↓
EDR Agent
   ↓
Collect Activity
   ↓
Central EDR Console
   ↓
Detect
   ↓
Investigate
   ↓
Respond
```

* * *

# Task 2 — What Is an EDR?

This task explains **why EDR exists**.

Organizations once relied heavily on protections located around their internal network.

But endpoints now operate from:

```text
Corporate offices
Homes
Hotels
Public networks
Remote locations
Cloud-connected environments
```

That makes endpoint-level protection extremely important.

TryHackMe defines EDR as a security solution that provides deep endpoint protection and continuously monitors devices regardless of where they are located. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# The Three Pillars of EDR

The room presents three core EDR capabilities:

```text
Visibility
Detection
Response
```

These are the easiest way for me to remember what an EDR actually does.

* * *

## 1\. Visibility 👁️

EDR collects detailed information from endpoints.

Examples include:

```text
Process activity

File activity

Folder changes

Registry changes

User actions

Network connections

Command execution
```

Instead of seeing only:

```text
"Malware detected"
```

an analyst may be able to reconstruct:

```text
User opened document
        ↓
Document launched child process
        ↓
Child process launched PowerShell
        ↓
PowerShell downloaded file
        ↓
File executed
        ↓
Process connected externally
```

That is much more useful for investigation.

* * *

# Process Trees

One especially important EDR feature is the:

# Process Tree

Processes often have relationships.

For example:

```text
explorer.exe
     ↓
winword.exe
     ↓
powershell.exe
     ↓
payload.exe
```

The EDR can show:

```text
Parent Process
      ↓
Child Process
      ↓
Grandchild Process
```

This makes unusual relationships easier to identify.

TryHackMe uses a graphical process tree to demonstrate how EDR lets analysts view spawned processes and associated network, registry, and file activity. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 2\. Detection 🔍

EDR does more than compare files against known malware signatures.

Detection mechanisms can include:

```text
Signature matching
Behavior analysis
Machine learning
IOC matching
Anomaly detection
```

For example:

```text
Microsoft Word
      ↓
spawns
      ↓
PowerShell
```

may deserve attention because that parent-child relationship can be unusual.

* * *

## 3\. Response 🛑

Detection alone is not enough.

EDR can also let analysts take actions such as:

```text
Isolate host
Terminate process
Quarantine file
Remotely investigate endpoint
Collect artifacts
```

TryHackMe emphasizes that analysts can perform many of these actions directly from the centralized EDR console. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## Common EDR Products

The room gives examples including:

```text
CrowdStrike Falcon
Microsoft Defender for Endpoint
SentinelOne
Symantec EDR
```

Different products have different interfaces and features, but their overall architecture and goals are similar. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 🛠️ Hands-On / Tools — Task 2

### Concepts Practiced

```text
EDR console
Endpoint visibility
Process trees
Detections
Response actions
```

My revision model:

```text
        EDR
         |
 ┌───────┼───────┐
 |       |       |
View   Detect  Respond
```

* * *

# Task 3 — Beyond the Antivirus

This was one of the most useful conceptual tasks.

The question is:

> If we already have antivirus, why do we need EDR?

Both protect endpoints, but they provide different levels of visibility and detection.

* * *

# Traditional Antivirus

Traditional antivirus has historically relied strongly on:

```text
Known malware signatures
Known malicious files
Known patterns
```

Conceptually:

```text
File arrives
    ↓
Compare against known signatures
    ↓
Match?
 /      \
Yes      No
 |        |
Block   Allow
```

The problem appears when the attack is:

```text
New
Obfuscated
Fileless
Living off the land
Behavior-based
```

* * *

# EDR

EDR continuously monitors what happens **after execution** as well.

Instead of only asking:

```text
Is this file known to be malicious?
```

EDR may also ask:

```text
What is this process doing?

What spawned it?

What commands did it run?

Which files did it modify?

Where did it connect?

Does this behavior look normal?
```

* * *

# Airport Analogy

TryHackMe uses a useful analogy.

Think of the endpoint as an:

```text
Airport
```

Traditional antivirus behaves somewhat like:

```text
Immigration check
```

It compares people against known information.

EDR behaves more like:

```text
Security officers
+
Cameras
+
Continuous monitoring
```

Even if someone passes the first security check, suspicious behavior inside the airport can still be detected. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# Example Attack Chain

A simplified attack might look like:

```text
Phishing document
      ↓
User opens document
      ↓
Macro executes
      ↓
PowerShell launches
      ↓
Payload downloaded
      ↓
Process injection
      ↓
External connection
```

An antivirus might miss parts of this if individual files or actions do not match known signatures.

EDR can potentially observe the **entire chain of behavior**, including unusual process relationships, obfuscated commands, injection, and network activity from the endpoint. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# Antivirus vs EDR

| Antivirus | EDR |
| --- | --- |
| Strong focus on prevention | Prevention + detection + investigation + response |
| Often signature focused | Signature + behavior + anomaly detection |
| Limited investigation context | Detailed endpoint telemetry |
| Detects known malicious files well | Can detect advanced behavioral chains |
| Limited response workflow | Analyst-driven response capabilities |
| Primarily endpoint protection | Endpoint monitoring, detection, investigation and response |

Modern antivirus products can be much more capable than older signature-only tools, but the main learning point remains that EDR provides deeper visibility and response functionality. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 🛠️ Hands-On / Methodology — Task 3

This task was mainly about **reasoning through an attack chain**.

My workflow was:

```text
Look at individual action
        ↓
Looks harmless?
        ↓
Check parent process
        ↓
Check next action
        ↓
Build full chain
        ↓
Reassess behavior
```

Key takeaway:

> One event may look legitimate. The complete sequence may not.

* * *

# Task 4 — How an EDR Works

Now the room explains the architecture behind EDR.

At a high level, there are two important pieces:

```text
EDR Agent
+
EDR Console
```

* * *

# EDR Agent / Sensor

The EDR agent is installed on endpoints.

Think of it as the:

```text
Eyes and ears
```

of the EDR.

It monitors local activity such as:

```text
Processes
Commands
Files
Registry
Network connections
User actions
```

and sends relevant information to the centralized EDR infrastructure. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# Central EDR Console

The centralized console receives endpoint telemetry.

Conceptually:

```text
Endpoint A ───┐
Endpoint B ───┤
Endpoint C ───┤
Server D ─────┤
              ↓
         EDR Console
              ↓
     Correlation & Analysis
              ↓
          Detection
```

The platform may apply:

```text
Detection rules
Threat intelligence
Behavioral analysis
Machine learning
Correlation
```

to identify suspicious activity. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# After a Detection

The workflow becomes:

```text
EDR detection
      ↓
Severity assigned
      ↓
SOC analyst reviews
      ↓
Investigate activity
      ↓
False Positive?
or
True Positive?
      ↓
Take appropriate action
```

Typical severity levels may include:

```text
Critical
High
Medium
Low
Informational
```

* * *

# EDR and SIEM Together

EDR is powerful, but it does not contain every security data source.

A SOC may also use:

```text
Firewall
DLP
Email Gateway
IAM
Proxy
Network security tools
```

Their data may be integrated into:

```text
SIEM
```

giving analysts a broader investigation platform.

So:

```text
EDR
  ↓
Deep endpoint context

SIEM
  ↓
Broad cross-environment context
```

They complement each other. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 🛠️ Hands-On / Tools — Task 4

### Tools / Concepts Used

```text
EDR Agent
EDR Console
Threat Intelligence
Alert Severity
SOC workflow
SIEM integration
```

My architecture diagram:

```text
ENDPOINT
   |
 EDR Agent
   |
   v
TELEMETRY
   |
   v
EDR CONSOLE
   |
   v
ANALYTICS
   |
   v
DETECTION
   |
   v
SOC ANALYST
```

* * *

# Task 5 — EDR Telemetry

This task focuses on one of the most important EDR concepts:

# Telemetry

Telemetry is the detailed endpoint data collected by the EDR agent.

TryHackMe describes it as effectively the endpoint's **black box**, containing the information needed to detect threats and reconstruct activity during investigations. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# 1\. Process Execution and Termination

EDR may record:

```text
Process name
Parent process
Child process
Start time
End time
Execution path
```

This is useful for identifying suspicious chains.

Example:

```text
winword.exe
     ↓
powershell.exe
     ↓
unknown.exe
```

* * *

# 2\. Network Connections

The endpoint's network activity can also be monitored.

This may reveal:

```text
Remote IP
Remote domain
Port
Process creating connection
Connection time
```

Security uses include identifying:

```text
C2 communication
Unusual ports
Data exfiltration
Lateral movement
```

* * *

# 3\. Command-Line Activity

EDR can capture commands executed through tools such as:

```text
CMD
PowerShell
```

This is extremely useful because attackers often use legitimate built-in utilities.

Example:

```text
powershell.exe
   ↓
encoded / obfuscated command
```

The binary itself is legitimate.

The **command** may be malicious.

* * *

# 4\. File and Folder Modifications

EDR can monitor:

```text
Files created
Files modified
Files deleted
Files renamed
Directories changed
```

This helps detect behavior such as:

```text
Malware dropping payloads
Ransomware modifying files
Data staging
Suspicious file creation
```

* * *

# 5\. Registry Modifications

Windows Registry changes can reveal:

```text
Persistence
Configuration changes
Startup modifications
Security-setting changes
```

EDR can capture many of these modifications and link them to the process responsible.

* * *

# Why Telemetry Matters

Individual actions may look legitimate.

For example:

```text
PowerShell executed
```

is not automatically malicious.

But:

```text
Document opens
      ↓
PowerShell launches
      ↓
PowerShell downloads executable
      ↓
Executable modifies registry
      ↓
Executable contacts unknown server
```

is much more suspicious.

Telemetry lets analysts reconstruct this chain. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 🛠️ Hands-On / Tools — Task 5

### Telemetry I Focused On

```text
Process tree
Command line
File path
Registry changes
Network connections
User
Hostname
Timestamps
```

My investigation order:

```text
PROCESS
   ↓
PARENT
   ↓
COMMAND
   ↓
FILE
   ↓
NETWORK
   ↓
REGISTRY
   ↓
TIMELINE
```

* * *

### Optional Local Practice

Outside the TryHackMe room, similar Windows information can be explored safely using:

```powershell
Get-Process
```

and:

```powershell
Get-NetTCPConnection
```

These are not replacements for EDR telemetry, but they help build intuition about the endpoint activity an EDR observes.

* * *

# Task 6 — Detection and Response Capabilities

This task goes deeper into how EDR identifies advanced threats.

* * *

# Detection Techniques

## 1\. Behavioral Detection

Instead of asking:

```text
Is this file known malware?
```

behavioral detection asks:

```text
Is this behavior suspicious?
```

Example:

```text
winword.exe
     ↓
powershell.exe
```

This parent-child relationship may be unusual enough to warrant investigation.

* * *

## 2\. Anomaly Detection

Over time, an EDR can understand normal endpoint behavior.

If something deviates strongly from that baseline:

```text
Normal Behavior
      ↓
Unexpected Change
      ↓
Anomaly
      ↓
Detection
```

Anomalies can generate false positives, so analyst context remains important.

* * *

## 3\. IOC Matching

IOC stands for:

```text
Indicator of Compromise
```

Examples include:

```text
Malicious file hash
IP address
Domain
URL
```

The EDR can compare endpoint activity with threat-intelligence feeds.

```text
Observed hash
      ↓
Threat Intelligence
      ↓
Known malicious?
```

If yes, the activity can be flagged quickly.

* * *

## 4\. MITRE ATT&CK Mapping

EDR detections may be mapped to:

```text
MITRE ATT&CK
```

For example:

```text
Activity:
Scheduled task created

Tactic:
Persistence

Technique:
Scheduled Task / Job
```

This gives the analyst additional context about **where the activity fits within an attack lifecycle**. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## 5\. Machine Learning

Modern EDR systems may use machine learning to identify complex patterns.

This becomes helpful when:

```text
Individual Activity A → Not obviously malicious

Individual Activity B → Not obviously malicious

Individual Activity C → Not obviously malicious

A + B + C together → Suspicious pattern
```

This can help identify multi-stage or fileless attacks.

* * *

# Response Capabilities

After detection comes:

# Response

TryHackMe covers several important actions. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

## Isolate Host

```text
Compromised Endpoint
      ↓
Network Isolation
      ↓
Lateral Movement Reduced
```

This can be extremely useful when a threat is actively spreading.

* * *

## Terminate Process

Sometimes isolating the whole host would disrupt important business activity.

Instead:

```text
Malicious Process
      ↓
Terminate
```

may be enough.

Analysts need to be careful because terminating legitimate critical processes can also disrupt systems.

* * *

## Quarantine File

A malicious file can be moved to an isolated state where it cannot execute normally.

```text
Suspicious File
      ↓
Quarantine
      ↓
Review / Remove / Restore
```

* * *

## Remote Access

EDR platforms may allow security analysts to remotely interact with an endpoint.

This can be used for:

```text
Additional investigation
Custom commands
Collecting evidence
Running scripts
Taking response actions
```

* * *

## Artifact Collection

Analysts may need to collect:

```text
Memory dumps
Event logs
Registry hives
Specific files
Folder contents
```

for deeper forensic investigation.

* * *

## 🛠️ Hands-On / Workflow — Task 6

My response decision tree became:

```text
TRUE POSITIVE
     ↓
How serious?
     ↓
Is attack active?
     ↓
Contain
     ↓
 ┌─────────────┬──────────────┐
 |             |              |
Isolate     Terminate      Quarantine
 Host        Process          File
     \           |             /
      \          |            /
       └─────────┴───────────┘
                 ↓
          Collect Evidence
```

* * *

# Task 7 — Investigate an Alert on EDR

This was the practical part of the room.

TryHackMe provides a simulated EDR dashboard with several detections.

The task is to investigate the detections using the visibility available inside the EDR. The exercise intentionally focuses on understanding detection context rather than performing response actions. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# My Investigation Workflow

Instead of searching directly for the question answer, I used a repeatable investigation method.

```text
Open Detection
      ↓
Identify Host
      ↓
Identify User
      ↓
Inspect Process Tree
      ↓
Find Suspicious Parent / Child
      ↓
Read Command Line
      ↓
Inspect File Activity
      ↓
Inspect Network Activity
      ↓
Check Threat Intelligence
      ↓
Build Attack Timeline
```

* * *

# Step 1 — Identify the Endpoint

First:

```text
Which machine triggered the alert?
```

The hostname is important because several alerts may exist for different systems.

* * *

# Step 2 — Look at the Process Tree

I examine:

```text
Parent
   ↓
Child
   ↓
Grandchild
```

and ask:

```text
Does this relationship make sense?
```

For example:

```text
User application
      ↓
Command shell
      ↓
Downloader
```

may deserve attention.

* * *

# Step 3 — Inspect Command-Line Arguments

The executable name alone often does not reveal enough.

For example:

```text
cmd.exe
```

is legitimate.

So is:

```text
powershell.exe
```

But what matters is:

```text
What command did it run?
```

Command-line telemetry can reveal:

```text
Download commands
Encoded commands
Suspicious scripts
File paths
Remote URLs
```

* * *

# Step 4 — Inspect File Activity

Look for:

```text
Downloaded files
Created executables
Temporary paths
Unexpected directories
Renamed files
```

Absolute paths are especially useful because they tell us **where the artifact actually exists**.

* * *

# Step 5 — Inspect Network Activity

Questions include:

```text
Which process made the connection?

Which domain / URL?

Which remote IP?

Which port?

Was data uploaded?
```

This can reveal:

```text
C2
Payload download
Data exfiltration
```

* * *

# Step 6 — Check Threat Intelligence Context

Some EDR platforms enrich detections with threat-intelligence information.

This can help answer:

```text
Is the file known?

Has this hash been seen before?

How is it classified?

Is it associated with malware?
```

But threat intelligence should be combined with behavior rather than used blindly.

* * *

# Step 7 — Reconstruct the Timeline

The final goal is not simply to answer:

```text
What filename?
```

The goal is to understand:

```text
What happened from beginning to end?
```

For example:

```text
Initial process
      ↓
Command execution
      ↓
Download
      ↓
Payload execution
      ↓
Network activity
      ↓
Potential exfiltration
```

That is the real value of EDR visibility.

* * *

## 🛠️ Hands-On / Tools — Task 7

### Tools Used

```text
TryHackMe simulated EDR
Detection dashboard
Process tree
Command-line telemetry
File telemetry
Network telemetry
Threat-intelligence enrichment
```

I intentionally excluded:

```text
❌ Downloader-tool answer
❌ Malware path
❌ Suspicious executable path
❌ Exfiltration URL
❌ Threat-intelligence classification answer
```

so other learners can investigate the detections themselves.

* * *

# Task 8 — Conclusion

By the end of the room, EDR no longer felt like:

```text
"Antivirus with more features"
```

Instead, I now understand it as:

```text
                 ENDPOINT
                    |
                    v
                EDR AGENT
                    |
                    v
                TELEMETRY
                    |
       ┌────────────┼─────────────┐
       |            |             |
   Processes      Files        Network
       |          Registry      Commands
       └────────────┼─────────────┘
                    |
                    v
               EDR CONSOLE
                    |
                    v
                 DETECTION
                    |
        ┌───────────┼───────────┐
        |           |           |
   Behavior       IOC       Anomaly / ML
        |           |           |
        └───────────┼───────────┘
                    |
                    v
                SOC ANALYST
                    |
                    v
               INVESTIGATION
                    |
                    v
                 RESPONSE
```

TryHackMe closes the room by reinforcing EDR architecture, telemetry, advanced detection mechanisms, response capabilities, and practical alert investigation. ([TryHackMe](https://tryhackme.com/room/introductiontoedrs?utm_source=chatgpt.com))

* * *

# EDR Telemetry Cheat Sheet

| Telemetry | What It Helps Identify |
| --- | --- |
| Process execution | Suspicious parent-child relationships |
| Command line | Malicious or obfuscated commands |
| Network connections | C2, lateral movement, exfiltration |
| File changes | Malware drops, ransomware, staging |
| Registry changes | Persistence and configuration changes |
| User activity | Who performed the action |
| Process tree | Complete execution chain |
| Timestamps | Reconstructing the attack timeline |

* * *

# Detection Cheat Sheet

| Detection Type | Main Idea |
| --- | --- |
| Signature | Matches known threat |
| Behavioral | Detects suspicious actions |
| Anomaly | Detects deviation from baseline |
| IOC Matching | Matches known indicators |
| MITRE Mapping | Maps activity to attack tactic/technique |
| Machine Learning | Identifies complex behavioral patterns |

* * *

# Response Cheat Sheet

| Response | Purpose |
| --- | --- |
| Isolate Host | Contain endpoint |
| Terminate Process | Stop malicious execution |
| Quarantine File | Prevent suspicious file execution |
| Remote Access | Investigate/respond directly |
| Collect Artifacts | Support deeper forensic analysis |

* * *

# Key Lessons Learned

## 1\. EDR Is About Visibility as Much as Detection

A detection saying:

```text
Malware found
```

is useful.

But:

```text
Process tree
+
Command line
+
Files
+
Registry
+
Network
+
Timeline
```

is far more valuable for investigation.

* * *

## 2\. Context Can Reveal What Signatures Miss

A legitimate process can perform malicious activity.

```text
PowerShell
```

is not malware.

But:

```text
Document
   ↓
PowerShell
   ↓
Obfuscated downloader
```

may be suspicious.

* * *

## 3\. Telemetry Tells the Attack Story

Rather than viewing isolated alerts:

```text
Event A
Event B
Event C
```

EDR can help us see:

```text
A
 ↓
B
 ↓
C
 ↓
Attack Chain
```

* * *

## 4\. Antivirus and EDR Are Not the Same

A useful mental model is:

```text
Antivirus
    ↓
Primarily prevention/detection

EDR
    ↓
Visibility
+
Detection
+
Investigation
+
Response
```

* * *

## 5\. Response Must Be Context-Aware

Immediately isolating every host would be a poor strategy.

A production server may be business-critical.

Sometimes:

```text
Terminate process
```

is better than:

```text
Isolate entire host
```

Response requires both security judgment and business awareness.

* * *

## 6\. Process Trees Are Extremely Valuable

Whenever I investigate an EDR alert, one of my first questions is now:

> **Who spawned whom?**

A suspicious child process can completely change the meaning of an otherwise legitimate application.

* * *

# My Final EDR Investigation Model

```text
                   DETECTION
                       |
                       v
                     HOST
                       |
                       v
                 PROCESS TREE
                       |
             ┌─────────┼─────────┐
             |         |         |
          Parent     Child     Command
             |         |         |
             └─────────┼─────────┘
                       |
                  FILE ACTIVITY
                       |
                       v
               NETWORK ACTIVITY
                       |
                       v
              REGISTRY / USER DATA
                       |
                       v
              THREAT INTELLIGENCE
                       |
                       v
                 BUILD TIMELINE
                       |
               ┌───────┴───────┐
               |               |
             BENIGN         MALICIOUS
               |               |
             CLOSE           RESPOND
```

* * *

# Ethical Learning Note

This article is a **learning guide rather than an answer dump**.

I included:

```text
✅ EDR architecture
✅ EDR vs antivirus
✅ Telemetry concepts
✅ Detection techniques
✅ Response capabilities
✅ Alert investigation workflow
✅ Generic examples
```

while intentionally excluding:

```text
❌ TryHackMe answers
❌ Malware paths
❌ Exfiltration URL
❌ Threat-intelligence answer
❌ Dashboard-specific values
❌ Direct task submissions
```

The goal is to document the methodology while leaving the actual EDR investigation exercise for other learners to solve themselves.

* * *

# Resources

*   🌐 **TryHackMe Room:** [Introduction to EDR](https://tryhackme.com/room/introductiontoedrs)
    
*   👨‍💻 **TryHackMe Profile:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   💻 **GitHub Repository:** [tryhackme-writeups](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   ✍️ **Hashnode Blog:** [cybersecurity-learning.hashnode.dev](https://cybersecurity-learning.hashnode.dev/)
    

* * *

# Connect with Me

*   **TryHackMe:** [sunnysharma11200](https://tryhackme.com/p/sunnysharma11200)
    
*   **GitHub:** [SunnySharma04](https://github.com/SunnySharma04/tryhackme-writeups)
    
*   **Hashnode:** [cybersecurity-learning](https://cybersecurity-learning.hashnode.dev/)
    
*   **LinkedIn:** [Sunny Sharma](https://www.linkedin.com/in/sunny-sharma-2487312a7/)
    

* * *

*Happy Learning!* 🚀