A Windows endpoint begins executing PowerShell commands that download a second-stage payload, spawn a new process, and inject code into a legitimate svchost.exe process. Which EDR capability is MOST critical for detecting this fileless attack chain?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — behavioral analysis and process tree monitoring is what you need, because this fileless attack lives in memory and abuses legitimate processes. It catches PowerShell spawning odd child processes and cross-process injection even when there's no bad file to hash or scan.
Full Explanation
Behavioral analysis and process tree monitoring that detects PowerShell spawning unusual child processes and cross-process memory injection is correct because the attack uses fileless techniques and process injection into a legitimate process, both of which bypass file-hash and signature-based detection. Behavioral EDR detects anomalous behavior such as PowerShell as a parent of unusual processes and cross-process memory writes, regardless of file signatures. Static file hash comparison against known malware signature databases is wrong because code injected into svchost.exe has no file to hash. Network flow analysis of the affected endpoint's outbound connections is wrong because it may detect the download but not the injection into a legitimate process. Signature-based antivirus scanning of any files downloaded from the internet is wrong because the injected payload in memory has no file signature to scan.