This book demystifies Endpoint Detection and Response (EDR) technology, which is used by almost every business to monitor their network devices. Through an in-depth analysis, you will learn how EDRs detect attacker activity. Each chapter reveals that EDR is not a magical black box, but a complex software application with key elements that are easily understood. The author, with years of experience as a red team operator, examines the most common sensor elements, analyzes their purpose, explains their application, and showcases ways to collect various data from the Microsoft operating system. In addition to the theory behind designing an effective EDR, each chapter reveals obfuscation strategies that red teams can use in their missions.

Pages: 312, Dimensions: 17.8x17.8cm