What happens if attackers disable our EDR?

The endpoint goes quiet, and the endpoint tool cannot report its own silence, so you need a second witness. Disabling or uninstalling endpoint protection is a common early step for intruders and ransomware operators, using stolen admin rights or a vulnerable driver. From then on, the console may show the machine as offline or simply stop receiving events from it. Two things help. First, treat a silent agent as an incident: set an alert in your EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. console for agents that stop reporting, and check who has the rights to uninstall it. Second, watch the network, which the attacker cannot switch off from that one machine. NetSenX keeps seeing the host's behaviour whatever happens to its EDR: beaconing, scanning, lateral movement and unusual uploads. It does not see the EDR's own state, so it will not tell you that the agent stopped; it tells you what the machine does next.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics