<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-detection-engineering
description: >-
  Design, implement, and tune endpoint detection rules for process, file, registry, and memory-based threats across Windows, Linux, and macOS platforms.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - endpoint-detection
  - edr
  - process-monitoring
  - sysmon
  - etw
  - auditd
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059"]
---

# Performing Endpoint Detection Engineering

## Overview

Endpoint detection engineering focuses on host-level threat detection using
process telemetry, file system events, registry changes, and memory analysis.
Covers Sysmon, ETW, auditd, and EDR platform rule development.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysmon | Windows telemetry collection |
| auditd | Linux audit framework |
| EDR platform | CrowdStrike, Defender, SentinelOne, or Carbon Black access |

## Key Concepts

### Endpoint Detection Patterns

```xml
<!-- Sysmon config for process injection detection -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup groupRelation="or">
      <ProcessAccess onmatch="include">
        <Rule name="LSASS Access" groupRelation="and">
          <TargetImage condition="is">C:\Windows\System32\lsass.exe</TargetImage>
          <GrantedAccess condition="is">0x1010</GrantedAccess>
          <SourceImage condition="excludes">csrss.exe</SourceImage>
        </Rule>
      </ProcessAccess>
      <CreateRemoteThread onmatch="include">
        <Rule name="Remote Thread Injection" groupRelation="and">
          <SourceImage condition="excludes">svchost.exe</SourceImage>
        </Rule>
      </CreateRemoteThread>
    </RuleGroup>
  </EventFiltering>
</Sysmon>
```

## Workflow

1. **Identify technique** — Map endpoint TTP to required telemetry source
2. **Configure collection** — Ensure Sysmon, auditd, or EDR captures needed events
3. **Author detection** — Write rule using process, file, or registry indicators
4. **Test on endpoint** — Execute benign simulation and verify alert fires
5. **Baseline environment** — Profile normal behavior to establish filters
6. **Tune false positives** — Add exclusions for legitimate software and processes
7. **Deploy across fleet** — Push rules to all managed endpoints

## Detection

```yaml
title: Endpoint Detection Engineering Detection
id: 912b7471-0fed-4017-b34a-c88d50aedb98
status: experimental
description: Detects suspicious activity related to performing endpoint detection engineering techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*endpoint*"
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
