<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: endpoint-security
description: >-
  Comprehensive endpoint security operations including EDR deployment, endpoint
  hardening, fileless attack detection, application whitelisting, forensic
  collection, credential theft detection, patch management, vulnerability
  assessment, persistence mechanism detection, logging configuration, threat
  hunting, and endpoint isolation procedures.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - edr
  - endpoint-hardening
  - fileless-attacks
  - application-whitelisting
  - endpoint-forensics
  - credential-theft
  - patch-management
  - vulnerability-assessment
  - persistence-detection
  - endpoint-logging
  - threat-hunting
  - endpoint-isolation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack:
    - T1059   # Command and Scripting Interpreter
    - T1003   # OS Credential Dumping
    - T1055   # Process Injection
    - T1547   # Boot or Logon Autostart Execution
    - T1053   # Scheduled Task/Job
    - T1078   # Valid Accounts
    - T1562   # Impair Defenses
    - T1027   # Obfuscated Files or Information
    - T1218   # System Binary Proxy Execution
    - T1070   # Indicator Removal
    - T1490   # Inhibit System Recovery
    - T1105   # Ingress Tool Transfer
  nist-csf:
    - DE.CM   # Security Continuous Monitoring
    - DE.AE   # Anomalies and Events
    - DE.DP   # Detection Processes
    - PR.IP   # Information Protection Processes
    - PR.PT   # Protective Technology
    - PR.AC   # Identity Management and Access Control
    - RS.AN   # Analysis
    - RS.MI   # Mitigation
    - RS.RP   # Response Planning
    - RC.RP   # Recovery Planning
  frameworks:
    - CIS Controls v8
    - NIST SP 800-53
    - MITRE ATT&CK
    - NIST SP 800-123
    - DISA STIG
---

# SKILL: Endpoint Security

## When to Use

Activate this skill when the operator asks about:
- **EDR deployment** — agent rollout, policy configuration, telemetry validation
- **Endpoint hardening** — CIS benchmarks, STIG compliance, attack surface reduction
- **Fileless attack detection** — memory-resident malware, script-based attacks, LOLBins
- **Application whitelisting** — AppLocker, WDAC, software restriction policies
- **Endpoint forensics** — triage collection, memory acquisition, artifact preservation
- **Credential theft detection** — LSASS protection, credential guard, DCSync detection
- **Patch management** — WSUS, SCCM, vulnerability-driven patching workflows
- **Vulnerability assessment** — endpoint scanning, risk prioritization, remediation tracking
- **Persistence detection** — autoruns, scheduled tasks, WMI subscriptions, registry keys
- **Logging configuration** — Sysmon, Windows Event Forwarding, auditd, osquery
- **Endpoint threat hunting** — hypothesis-driven hunts on endpoint telemetry
- **Endpoint isolation** — network quarantine, containment procedures, blast radius control

## Prerequisites

| Requirement | Purpose |
|---|---|
| EDR platform (CrowdStrike/Defender/SentinelOne) | Endpoint telemetry and response |
| Sysmon | Process-level telemetry on Windows (EID 1–26) |
| auditd | Syscall auditing on Linux endpoints |
| osquery | Cross-platform endpoint visibility |
| Velociraptor | Endpoint forensic collection and hunting |
| KAPE | Windows triage artifact collection |
| Volatility 3 | Memory forensics analysis |
| AppLocker / WDAC | Application whitelisting on Windows |
| WSUS / SCCM | Windows patch management infrastructure |

## Quick Reference

```bash
# EDR agent status check
sc query CrowdStrike | findstr STATE
systemctl status falcon-sensor

# Sysmon installation and config
sysmon64 -accepteula -i sysmonconfig.xml
sysmon64 -c sysmonconfig.xml

# osquery interactive
osqueryi --json "SELECT * FROM processes WHERE name = 'powershell.exe';"

# Velociraptor collection
velociraptor collect -i Windows.KapeFiles.Targets --output triage.zip

# AppLocker policy export
Get-AppLockerPolicy -Effective -Xml | Out-File applocker-policy.xml

# LSASS protection status
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL

# Autoruns baseline
autorunsc64 -accepteula -a * -c -h -s -v -vt > autoruns_baseline.csv

# Windows Event Forwarding status
wecutil gs "ForwardedEvents"

# Network isolation via firewall
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
iptables -P INPUT DROP && iptables -P OUTPUT DROP && iptables -P FORWARD DROP
```

| Task | Command |
|---|---|
| Check EDR agent health | `sc query <service>` / `systemctl status <agent>` |
| Deploy Sysmon config | `sysmon64 -c sysmonconfig.xml` |
| Query osquery fleet | `osqueryi "SELECT * FROM listening_ports;"` |
| Collect triage artifacts | `velociraptor collect -i Windows.KapeFiles.Targets` |
| Export AppLocker policy | `Get-AppLockerPolicy -Effective -Xml` |
| Check LSASS protection | `reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL` |
| List persistence mechanisms | `autorunsc64 -a * -c -h -s -v` |
| Validate patch compliance | `Get-HotFix \| Sort-Object InstalledOn -Descending` |
| Scan endpoint vulnerabilities | `nmap --script vuln -sV <target>` |
| Hunt for LOLBins | `Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1}` |
| Isolate endpoint (Windows) | `netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound` |
| Isolate endpoint (Linux) | `iptables -P INPUT DROP; iptables -P OUTPUT DROP` |

## Workflow

### 1. EDR Deployment & Telemetry

Deploy EDR agents with validated configuration. Verify telemetry flow from
endpoints to the central console. Validate detection coverage against ATT&CK.

→ **Technique:** [techniques/implementing-edr-deployment/](techniques/implementing-edr-deployment/SKILL.md)

### 2. Endpoint Hardening

Apply CIS benchmarks and DISA STIGs. Configure attack surface reduction rules.
Harden OS configurations and validate compliance.

→ **Technique:** [techniques/configuring-endpoint-hardening-baselines/](techniques/configuring-endpoint-hardening-baselines/SKILL.md)

### 3. Fileless Attack Detection

Detect memory-resident malware, script-based attacks, and LOLBin abuse.
Configure telemetry sources for in-memory threat visibility.

→ **Technique:** [techniques/detecting-fileless-attack-techniques/](techniques/detecting-fileless-attack-techniques/SKILL.md)

### 4. Application Whitelisting

Implement AppLocker or WDAC policies. Define trusted publisher rules,
path-based rules, and hash-based rules. Monitor enforcement events.

→ **Technique:** [techniques/implementing-application-whitelisting/](techniques/implementing-application-whitelisting/SKILL.md)

### 5. Endpoint Forensic Collection

Perform triage collection of volatile and non-volatile artifacts. Acquire
memory dumps. Preserve chain of custody for incident response.

→ **Technique:** [techniques/performing-endpoint-forensic-collection/](techniques/performing-endpoint-forensic-collection/SKILL.md)

### 6. Credential Theft Detection

Detect LSASS access, credential dumping, DCSync attacks, and Kerberoasting.
Configure protective controls and detection rules.

→ **Technique:** [techniques/detecting-credential-theft-on-endpoints/](techniques/detecting-credential-theft-on-endpoints/SKILL.md)

### 7. Patch Management

Manage endpoint patching via WSUS/SCCM. Prioritize patches using CISA KEV
and EPSS scores. Track compliance and remediation SLAs.

→ **Technique:** [techniques/implementing-endpoint-patch-management/](techniques/implementing-endpoint-patch-management/SKILL.md)

### 8. Vulnerability Assessment

Scan endpoints for vulnerabilities. Prioritize by exploitability and business
impact. Track remediation progress and validate fixes.

→ **Technique:** [techniques/performing-endpoint-vulnerability-assessment/](techniques/performing-endpoint-vulnerability-assessment/SKILL.md)

### 9. Persistence Detection

Identify boot/logon autoruns, scheduled tasks, WMI subscriptions, registry
modifications, and service installations used for persistence.

→ **Technique:** [techniques/detecting-persistence-mechanisms/](techniques/detecting-persistence-mechanisms/SKILL.md)

### 10. Logging Configuration

Configure Sysmon, Windows Event Forwarding, auditd, and osquery for
comprehensive endpoint visibility. Validate log delivery to SIEM.

→ **Technique:** [techniques/implementing-endpoint-logging-configuration/](techniques/implementing-endpoint-logging-configuration/SKILL.md)

### 11. Endpoint Threat Hunting

Conduct hypothesis-driven threat hunts using endpoint telemetry. Apply
stack counting, frequency analysis, and behavioral anomaly detection.

→ **Technique:** [techniques/performing-endpoint-threat-hunting/](techniques/performing-endpoint-threat-hunting/SKILL.md)

### 12. Endpoint Isolation

Execute network isolation procedures for compromised endpoints. Control
blast radius while preserving forensic evidence and management access.

→ **Technique:** [techniques/implementing-endpoint-isolation-procedures/](techniques/implementing-endpoint-isolation-procedures/SKILL.md)

### Key Chains

#### Chain: Fileless Attack → Detection → Containment
1. LOLBin abuse detected via Sysmon EID 1 (mshta.exe spawning PowerShell)
2. EDR telemetry confirms in-memory payload execution (no on-disk artifacts)
3. Credential theft detected — Sysmon EID 10 targeting lsass.exe
4. Persistence installed — WMI event subscription via EID 19/20/21
5. Endpoint isolated via EDR network containment API
6. Memory acquired before remediation (`winpmem_x64.exe -o mem.raw`)
7. Volatile artifacts collected via Velociraptor triage
8. Persistence removed, credentials rotated, detection rules updated

#### Chain: Vulnerability → Patch → Verify
1. Vulnerability scan identifies CVE on endpoint fleet
2. CISA KEV check — is this actively exploited? EPSS score?
3. Patch available — deploy via WSUS/SCCM to test group
4. Validate patch installation — `Get-HotFix` confirms KB present
5. Rescan endpoint — vulnerability no longer detected
6. Roll out to production fleet with monitoring

## Verification

| Check | Method |
|---|---|
| EDR agent connected | Console shows heartbeat within SLA |
| Sysmon generating events | `Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational -MaxEvents 1` |
| Hardening baseline applied | CIS-CAT or Ansible `--check` shows compliance |
| AppLocker enforcing | Event Log 8004 (block) events present for test binary |
| LSASS protection enabled | `RunAsPPL` registry value is `1` |
| Logging pipeline active | SIEM receives events within 60s of generation |
| Patch compliance met | `>95%` of critical patches deployed within SLA |
| Isolation effective | Isolated host cannot reach non-management networks |

## References

- [MITRE ATT&CK — Endpoint](https://attack.mitre.org/matrices/enterprise/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-123 — Guide to General Server Security](https://csrc.nist.gov/publications/detail/sp/800-123/final)
- [Sysmon Configuration Guide](https://github.com/SwiftOnSecurity/sysmon-config)
- [Velociraptor Documentation](https://docs.velociraptor.app/)
- [DISA STIGs](https://public.cyber.mil/stigs/)

---
v1.0 | Validated: 2026-03-18
