Classic antivirus programs compare files with known characteristics of malware, so-called signatures. Modern attacks, however, often work without a known malicious file: they use stolen credentials, legitimate administration tools or scripts. EDR therefore focuses on behavior. The solution continuously records what happens on a device and detects patterns that indicate an attack.
How does EDR work?
An agent runs on every endpoint and collects events: started processes, file changes, network connections, logins and changes to the system configuration. This data is analyzed centrally, usually in a cloud console. There, rules, behavioral analytics and current threat intelligence detect suspicious sequences, for example when an Office program suddenly starts a command line that downloads data from the internet.
When an alert is raised, response options are available:
- isolate the affected device from the network,
- terminate processes and move files to quarantine,
- trace the course of an attack to understand its origin and extent,
- search other devices for the same traces.
A widespread example is Microsoft Defender for Endpoint, see Microsoft Defender.
Typical examples
- A laptop begins renaming and encrypting large numbers of files. EDR recognizes the pattern of ransomware and isolates the device.
- A tool for extracting credentials is started on a server. The alert leads to the investigation of a compromised account.
- After a phishing campaign, the IT team checks on which devices the malicious attachment was opened.
What companies should keep in mind
- Roll out EDR on all endpoints and servers, including rarely used systems.
- Clarify who assesses alerts, also at night and on weekends, for example a Security Operations Center.
- Configure automatic responses deliberately and review them regularly.
- Ensure that the agent cannot easily be disabled and that devices without an active agent stand out.
- Link EDR data with other sources, for example in a SIEM.
How it differs
XDR (Extended Detection and Response) extends the approach beyond endpoints and also includes data from email, identities, cloud services and the network. MDR (Managed Detection and Response) refers to a service in which an external team continuously assesses alerts and responds to them.
View security services