Unit 02 of 03
Endpoint Protection
How many foothold points the protection layers close once code has run on the endpoint, and how many they only make visible: the spread and persistence behavior of malware types, the false positive and miss balance of signature and behavior-based detection over the same event set, the conflict between the visibility scope and the retention window of endpoint detection and response telemetry, how end-to-end traffic the perimeter rule never sees is closed by host-based filtering, how abuse of built-in and signed binaries lowers signature-based detection, and the split of the persistence mechanism inventory between what each audit closes and what it only logs.
Published Updated
Lessons
- 01 Malware Types Ten types are classified by spread mode and the foothold point each uses: the number of points per type, the two types that never establish persistence, the number of types using each point type alongside the legitimate item count at that same point, and the number of types that stop fully, stop partially, or stay unaffected when point types are closed cheapest first. 14 min read
- 02 Anti-Malware Software Twenty execution items are evaluated in the same set with two detection types: the items signature-based detection catches, misses, and falsely flags; the threshold scan of the behavior score derived from six indicators; how the missed count falls and the false positive count rises as the threshold drops; and the foothold point closed in block mode together with the legitimate work it cuts, versus the same point only made visible in alert mode. 13 min read
- 03 Endpoint Detection and Response Seven telemetry sources are measured against eight foothold point types: which point appears in which source, the two point types that appear in no source, the two sources that see no point type, how the visible point count stalls at six as sources are added in order of point gain per volume, how the daily volume shrinks the retention window from 6,657 days to 19.5 days, and the detections that do not fit inside the window. 14 min read
- 04 Host-Based Firewall and Prevention In a 432-endpoint model, 729,252 connection paths are counted and the 290,772 intra-zone paths the zone-boundary rule never sees at all are separated out: the paths a twelve-item host-based allowlist closes, the peer-to-peer traffic it has to leave open, the two legitimate flows it cuts because they were never written into the list, the way a denied path lands in the record, and the number of endpoints reachable in a single hop from a compromised endpoint. 14 min read
- 05 Living Off the Land The overlap of fourteen built-in, signed tools across seven capability classes is counted: an average of 3.4 tools carrying the same capability, three signature rules flagging zero of twenty-four runs, and three context dimensions — parent process, command pattern, timing — evaluated singly, combined, and intersected; five of six suspicious runs are separated out, one is identical in four dimensions to a legitimate run. 14 min read
- 06 Persistence Mechanisms Ten persistence point types are counted as an inventory and six controls run across four endpoint classes: how many types each control closes, how many it only makes visible, which control cannot be applied in which endpoint class; the number of types closed in all four classes is zero, the number of types no control touches is one, and the cost of closing is 36 blocked legitimate items plus 52 manual-review items. 14 min read