EDR Telemetry Collection
Collect comprehensive endpoint detection and response telemetry from compromised and at-risk systems. EDR provides process execution trees, file modifications, registry changes, network connections, and detection alerts that form the backbone of endpoint analysis.
Actions
- 1
CrowdStrike -- Export full RTR session data and detection details via the Falcon API: `GET /detects/queries/detects/v1?filter=device.hostname:"TARGET_HOST"`. Pull process tree JSON for each detection.
- 2
Microsoft Defender -- Run Advanced Hunting queries to extract process execution history, file events, and network connections for the investigation window. Export results to CSV for offline analysis.
- 3
Deploy a Velociraptor hunt across all in-scope hosts using the SANS triage collection: `velociraptor-v0.7.0 --config client.config.yaml artifacts collect Windows.KapeFiles.Targets --args target="!SANS_Triage" --output /case/host_triage/`.
- 4
Collect KAPE triage packages from systems without EDR coverage: `kape.exe --tsource C: --tdest \\forensic-share\case\%m --tflush --target !SANS_Triage --vhdx %m`. This captures event logs, registry hives, prefetch, amcache, shimcache, SRUM, and browser artifacts.
- 5
For each collected host, run Hayabusa against the event logs to generate a consolidated timeline: `hayabusa csv-timeline -d ./evtx_files/ -o timeline.csv --min-level medium -p verbose`.
- 6
Parse evidence of execution artifacts beyond event logs: AmCache (`AmcacheParser.exe -f AmCache.hve --csv .`), ShimCache (`AppCompatCacheParser.exe -f SYSTEM --csv .`), Prefetch (`PECmd.exe -d C:\Windows\Prefetch --csv .`), and BAM/DAM registry keys (`SYSTEM\CurrentControlSet\Services\bam\State\UserSettings`). These artifacts survive log clearing and provide execution evidence even when the attacker used `wevtutil cl` to wipe event logs.
- 7
Collect Windows Defender artifacts from systems where EDR may have been tampered with: quarantined files at `C:\ProgramData\Microsoft\Windows Defender\Quarantine\`, detection history at `C:\ProgramData\Microsoft\Windows Defender\Scans\History\DetectionHistory\`, and MPLog at `C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log`. These provide detection evidence independent of the EDR.
Queries
DeviceProcessEvents | where DeviceName in ("HOST1","HOST2","HOST3") | where Timestamp between (datetime(T_START) .. datetime(T_END)) | project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256 | order by DeviceName, Timestamp ascDeviceFileEvents | where DeviceName in ("HOST1","HOST2","HOST3") | where Timestamp between (datetime(T_START) .. datetime(T_END)) | where ActionType in ("FileCreated","FileModified","FileRenamed") | where FolderPath matches regex @"(?i)(\\temp\\|\\appdata\\|\\programdata\\|\\public\\)" | project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName | order by Timestamp ascDeviceRegistryEvents | where DeviceName in ("HOST1","HOST2","HOST3") | where Timestamp between (datetime(T_START) .. datetime(T_END)) | where RegistryKey has_any ("Run","RunOnce","Services","Wow6432Node\\Run","Image File Execution Options","AppInit_DLLs") | project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName | order by Timestamp ascindex=sysmon host IN ("HOST1","HOST2","HOST3") EventCode=1 earliest=T_START latest=T_END | stats count by Computer, Image, CommandLine, User, ParentImage | sort -countindex=sysmon host IN ("HOST1","HOST2","HOST3") EventCode=11 earliest=T_START latest=T_END TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\*" OR TargetFilename="*\\ProgramData\\*" | stats count by Computer, TargetFilename, Image | sort -count | head 50Notes
EDR telemetry retention varies by vendor: CrowdStrike retains 7-90 days depending on license, Defender retains 30 days by default. Export the data early.
KAPE and Velociraptor collections can generate large volumes of data (10-50 GB per host). Ensure forensic storage has sufficient capacity before starting.
If event logs have been cleared by the attacker (check for Security EID 1102 or System EID 104), pivot to non-log evidence of execution: Prefetch, AmCache, ShimCache, SRUM, BAM/DAM, and UserAssist artifacts survive `wevtutil cl` and provide substantial execution evidence.