#edr
All CosmicBytez Labs articles tagged #edr, across news, security advisories, how-to guides, and projects.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- Project
Fleet + osquery: Cross-Platform Endpoint Visibility and Live Queries
Deploy Fleet in Docker to fleet-manage osquery agents across Linux, macOS, and Windows, run live SQL queries against live endpoints, and alert on drift...
- News
FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse published FalconFlank, a public PoC abusing Falcon Sensor's macro remediation to claim SYSTEM-level access.
- HOWTO
What Is SentinelAgent.exe? SentinelOne's Agent Process
SentinelAgent.exe is the core SentinelOne EDR agent process on Windows. How to verify it is genuine, what drives its resource usage, and how to manage it.
- News
GodDamn Ransomware Deploys Microsoft-Signed PoisonX Driver to Kill EDR Tools
GodDamn ransomware — a rebrand of Beast/Monster — uses PoisonX, a malicious kernel driver that passed Microsoft's signing process, to terminate 400+...
- News
Gentlemen Ransomware Uses Multiple EDR Killers to Disable Defenses
The Gentlemen ransomware-as-a-service operation is actively developing and maintaining a suite of EDR killer tools to help affiliates evade detection and...
- HOWTO
EDR for SMBs: What It Actually Does, and Why Your Antivirus Isn't Enough
Endpoint Detection and Response is the single most important cybersecurity upgrade most Canadian SMBs can make in 2026. Here's what EDR actually does…
- News
Trellix Source Code Breach Highlights Growing Supply Chain
Trellix, the enterprise security vendor formed from the merger of McAfee Enterprise and FireEye, has suffered a source code breach claimed by the...
- HOWTO
How to Detect and Block ClickFix Attacks
Learn how to detect and prevent ClickFix social engineering attacks using EDR rules, network monitoring, YARA signatures, and endpoint hardening. Covers...
- HOWTO
SentinelOne Application Control Policies
Organizations face security risks from unauthorized applications, malware disguised as legitimate software, and shadow IT installations that bypass...
- HOWTO
SentinelOne Control vs Complete Feature Comparison
This document provides a comprehensive comparison between SentinelOne Singularity Control and Singularity Complete SKUs to help MSP teams understand the...
- HOWTO
SentinelOne Create and Manage Exclusion Policies
SentinelOne exclusion policies allow security teams to prevent false-positive detections and performance issues by excluding specific files, folders,...
- HOWTO
SentinelOne Data Retention and Storage Management
Organizations using SentinelOne Singularity Complete receive 14-365+ days of Deep Visibility EDR data retention by default. This historical telemetry...
- HOWTO
SentinelOne Deep Visibility Threat Hunting
Deep Visibility is SentinelOne's EDR telemetry engine that provides comprehensive endpoint data collection for threat hunting, incident investigation, and...
- HOWTO
SentinelOne Deploy Agent Manual Installation
Manual SentinelOne agent installation is used when automated deployment methods (GPO, RMM, SCCM) are unavailable or when installing on standalone...
- HOWTO
SentinelOne Deploy Agent via Group Policy
Deploying SentinelOne agents across Windows endpoints at scale using Active Directory Group Policy Objects (GPO) enables centralized, automated agent...
- HOWTO
Deploy SentinelOne Policy
Deploy, manage, and validate SentinelOne security policies across your endpoint estate using the SentinelOne Management API. This automated workflow supports:
- HOWTO
SentinelOne Device Control: Block USB & Bluetooth Devices
How to block USB drives and Bluetooth peripherals with SentinelOne Device Control — audit in Monitor mode, then enforce allow/block policies safely.
- HOWTO
SentinelOne File Fetch and Forensic File Collection
During threat investigations, security analysts need to retrieve suspicious files from endpoints for deeper forensic analysis. Traditional methods...
- HOWTO
SentinelOne Firewall Control Management
Traditional endpoint protection focuses on file-based malware, but network-based attacks (lateral movement, command-and-control callbacks, port scanning,...
- HOWTO
SentinelOne Forensics Rollback and Remediation
This document provides comprehensive procedures for forensic evidence collection, ransomware rollback, and threat remediation using SentinelOne Complete...
- HOWTO
SentinelOne Health Check: Agent Status Monitoring Guide
Organizations deploying SentinelOne endpoint protection require continuous monitoring of agent health to ensure comprehensive threat coverage across their...
- HOWTO
Invoke SentinelOne Threat Hunt
Proactive threat hunting is essential for identifying sophisticated threats that evade automated detection systems. This script automates the process of...
- HOWTO
SentinelOne MITRE ATT&CK Threat Hunting
The MITRE ATT&CK framework catalogs 14 tactics and 200+ techniques used by adversaries. Security teams need to proactively hunt for these techniques in...
- HOWTO
SentinelOne MSP Client Onboarding
This runbook provides a standardized process for onboarding new MSP clients to SentinelOne Singularity Complete. Following this methodology ensures...
- HOWTO
SentinelOne Policy Configuration Best Practices
This guide provides comprehensive best practices for configuring SentinelOne policies in MSP environments managing multiple client sites with Singularity...
- HOWTO
SentinelOne PowerShell API Automation
The SentinelOne Management Console REST API enables automation of administrative tasks, reporting, threat response, and integration with existing security...
- HOWTO
SentinelOne PowerShell Automation Scripts
This document provides a comprehensive library of production-ready PowerShell scripts for automating SentinelOne operations in an MSP environment. These...
- HOWTO
SentinelOne Purple AI Usage Guide
Security Operations Centers (SOCs) face overwhelming alert volumes, complex threat investigations, and resource constraints. Analysts spend hours writing...
- HOWTO
SentinelOne Ranger Network Discovery and IoT Visibility
Modern enterprise networks contain a complex mix of managed endpoints (workstations, servers), IoT devices (IP cameras, printers, smart building systems),...
- HOWTO
SentinelOne Remote Shell Operations
Full Remote Shell is a SentinelOne Complete feature that provides authorized administrators with secure, native command-line access to managed endpoints...
- HOWTO
SentinelOne RMM Integration Guide
This runbook provides comprehensive guidance for integrating SentinelOne Singularity Complete with NinjaRMM and other RMM platforms. Proper RMM...
- HOWTO
SentinelOne Sandbox Integration Configuration
SentinelOne detects suspicious files but automated malware analysis requires sandbox integration. Manually uploading files to VirusTotal, Joe Sandbox, or...
- HOWTO
SentinelOne STAR Advanced Automation and Watchlists
Security teams face the challenge of detecting organization-specific threats, insider threats, and policy violations that generic detection rules cannot...
- HOWTO
SentinelOne STAR Custom Detection Rules
Storyline Active Response (STAR) is SentinelOne's cloud-based automated hunting, detection, and response engine that allows security teams to create...
- HOWTO
SentinelOne Threat Investigation Workflow
When SentinelOne detects a threat on an endpoint, security analysts must quickly investigate the alert to determine if it's a genuine malware infection,...
- HOWTO
SentinelOne Timeline Forensics and Attack Chain Analysis
Understanding the complete attack chain requires correlating hundreds of events (process creation, network connections, file modifications, registry...
- HOWTO
Microsoft Defender for Endpoint: Configuration and Hardening
Deploy and configure Microsoft Defender for Endpoint. Covers onboarding methods, ASR rules, network protection, EDR in block mode, and automated investigation.
- HOWTO
SentinelOne Agent Deployment: EDR Installation Guide
Deploy and manage SentinelOne EDR agents across your environment. Covers manual installation, verification, troubleshooting, and best practices.
- HOWTO
SentinelOne Threat Hunting Recipes: Practical Deep
A practical recipe book of Deep Visibility hunts — encoded PowerShell, LOLBin abuse, lateral movement, persistence mechanisms. Each recipe is a copy-paste S1QL.
- Project
SentinelOne Complete Deployment Guide
Full deployment lifecycle for SentinelOne EDR - agent rollout, policy configuration, exclusions, threat hunting queries, and response playbooks.