<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-endpoint-telemetry
description: >-
  Collect and analyze endpoint telemetry from EDR platforms, Sysmon, and OS-native
  logs. Covers process trees, file system activity, registry modifications, network
  connections, and correlation across endpoint data sources.
domain: cybersecurity
subdomain: blue-team
tags:
  - endpoint-detection
  - edr
  - process-analysis
  - telemetry
  - threat-hunting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1057", "T1082"]
---

# Analyzing Endpoint Telemetry

## Overview

Endpoint telemetry provides the deepest visibility into adversary behavior — process
execution, file operations, registry changes, and network activity. Effective
analysis requires understanding process relationships, identifying anomalous
behaviors, and correlating across data sources to reconstruct attack chains.

## Prerequisites

| Requirement | Install |
|---|---|
| EDR platform | CrowdStrike, SentinelOne, MDE, or Sysmon |
| Sysmon v15+ | `sysmon64.exe -accepteula -i config.xml` |
| SIEM with endpoint data | Indexed process, file, registry, network events |
| Python 3.10+ | Analysis tooling |
| Velociraptor (optional) | `velociraptor gui` for endpoint forensics |

## Key Concepts

### Process Tree Analysis

```spl
| -- Reconstruct process tree for suspicious activity
index=sysmon EventCode=1
| eval process=Image." (PID: ".ProcessId.")"
| eval parent=ParentImage." (PID: ".ParentProcessId.")"
| table _time, ComputerName, parent, process, CommandLine, User
| sort _time

| -- Detect suspicious parent-child relationships
index=sysmon EventCode=1
| where (
    (ParentImage="*\\winword.exe" AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe"))
    OR (ParentImage="*\\outlook.exe" AND Image="*\\powershell.exe")
    OR (ParentImage="*\\explorer.exe" AND Image="*\\mshta.exe")
  )
| stats count by ParentImage, Image, CommandLine, User, ComputerName
```

### Endpoint Data Sources

| Source | Sysmon EID | MDE Table | Detection Value |
|---|---|---|---|
| Process creation | 1 | DeviceProcessEvents | Command-line analysis |
| Network connection | 3 | DeviceNetworkEvents | C2, lateral movement |
| Image load | 7 | DeviceImageLoadEvents | DLL injection, sideloading |
| Remote thread | 8 | DeviceProcessEvents | Process injection |
| Process access | 10 | DeviceProcessEvents | Credential dumping |
| File create | 11 | DeviceFileEvents | Payload drops |
| Registry | 12/13/14 | DeviceRegistryEvents | Persistence |
| DNS query | 22 | DeviceNetworkEvents | C2 resolution |

### KQL Endpoint Queries (Microsoft Defender)

```kql
// Suspicious PowerShell with encoded commands
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "FromBase64String")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

// Process injection via CreateRemoteThread
DeviceProcessEvents
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName !in ("csrss.exe", "lsass.exe", "svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName

// Unsigned DLL loaded by system process
DeviceImageLoadEvents
| where InitiatingProcessFileName in ("svchost.exe", "rundll32.exe")
| where not(FolderPath startswith "C:\\Windows\\")
| where SignatureState != "Valid"
```

### Sigma Rules for Endpoint Anomalies

```yaml
title: Process Injection via CreateRemoteThread from Non-System Process
id: b8c9d0e1-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects CreateRemoteThread calls from non-standard processes
logsource:
  category: create_remote_thread
  product: windows
detection:
  selection:
    EventType: CreateRemoteThread
  filter_system:
    SourceImage|endswith:
      - '\csrss.exe'
      - '\lsass.exe'
      - '\svchost.exe'
      - '\MsMpEng.exe'
  condition: selection and not filter_system
falsepositives:
  - Remote administration tools (verify legitimate use)
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.003
```

## Workflow

1. **Collect telemetry** — Ensure Sysmon/EDR forwarding to SIEM
2. **Map data sources** — Verify which ATT&CK data sources are available
3. **Build process trees** — Reconstruct execution chains from parent-child data
4. **Identify anomalies** — Flag unusual parent-child, unsigned binaries, injection
5. **Correlate** — Link process, file, registry, and network events by ProcessGUID
6. **Enrich** — Add threat intel context (file hashes, IP reputation)
7. **Document** — Record attack chain timeline with evidence
8. **Detect** — Convert confirmed patterns into automated detection rules

## Verification

| Check | Method |
|---|---|
| Telemetry flowing | Sysmon EID 1 events in SIEM from all endpoints |
| Process trees accurate | Parent-child relationships match expected chains |
| Key EIDs active | EID 1, 3, 7, 8, 10, 11, 22 generating events |
| Correlation working | ProcessGUID joins events across types |
| Detection rules firing | Test with simulated malicious behavior |

## References

- [Microsoft Defender for Endpoint Schema](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-schema-tables)
- [Sysmon Event Reference](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [MITRE ATT&CK Data Sources](https://attack.mitre.org/datasources/)
- [Velociraptor Documentation](https://docs.velociraptor.app/)
