Endpoints are where users work, where malware runs and where most intrusions start. Network controls help, but once a payload runs on a device, only controls on that device can see and stop what it does. This page covers the protective and detective tooling for endpoints. For secure configuration baselines (CIS benchmarks, disabling services, removing defaults), see System Hardening and do not duplicate it here.
What counts as an endpoint
- Laptops, desktops, and virtual desktops
- Servers (physical, virtual, cloud instances, containers hosts)
- Mobile phones and tablets, including personal devices (BYOD)
- IoT and OT devices, printers, point-of-sale
- Anything else that runs code and connects to the network
Every endpoint is part of the attack surface. Unmanaged and forgotten devices are the biggest gaps.
Evolution of endpoint protection
AV --> NGAV --> EDR --> XDR / MDR
sigs +behaviour +telemetry +cross-domain
+ML +response +managed service
| Stage | What it does | Limit |
|---|---|---|
| Antivirus (AV) | Scans files against known-bad signatures and heuristics | Misses new, fileless and living-off-the-land attacks |
| NGAV | Adds machine learning, behaviour analysis, exploit prevention | Prevention focused; less visibility after the fact |
| EDR | Records endpoint activity, detects suspicious behaviour, lets analysts investigate and respond | Needs skilled staff and tuning |
| XDR | Correlates endpoint with email, identity, network and cloud telemetry | Depends on integrations and data quality |
| MDR | A provider runs EDR/XDR monitoring and response for you (24x7) | Trust and scope of the provider; still needs internal ownership |
Signature matching remains useful, and rule languages such as YARA let defenders describe malware by patterns (see Hands-on).
How EDR works
- Telemetry: a lightweight agent records process creation and parent/child trees, command lines, file and registry changes, network connections, logins, module loads and script execution, and streams it to a backend.
- Detection: rules, threat intelligence and behavioural analytics flag patterns such as an Office app spawning PowerShell, credential dumping from LSASS, or a process injecting into another.
- Investigation: analysts search the timeline and process tree to scope an incident and find affected hosts.
- Response: from the console, isolate a host from the network (keeping the agent channel), kill a process, quarantine a file, collect forensic data, or roll back changes.
EDR data is also a feed for the SOC and SIEM (Security Operations Center, SIEM and Log Management) and underpins investigations (Digital Forensics, Incident Response Process).
Core endpoint controls
EPP vs EDR
| EPP (Endpoint Protection Platform) | EDR | |
|---|---|---|
| Goal | Prevent known and common threats | Detect, investigate and respond to what got through |
| Methods | Signatures, ML, exploit blocking, device control | Continuous recording, behavioural detection, threat hunting |
| Output | Blocked/quarantined items | Alerts, timelines, response actions |
| Typical today | Combined in one agent | Combined in one agent |
Most vendors now ship both in one agent; the real question is whether someone is watching and responding to the alerts.
Application allowlisting
Only approved software may run; everything else is blocked by default (for example Windows AppLocker/WDAC or macOS/Linux equivalents). It is highly effective against unknown malware and ransomware, but needs maintenance for updates and new tools. Start in audit mode. Allowlisting by publisher or hash is stronger than by path (writable paths are exploitable).
Host firewall and HIDS
A host firewall limits inbound and outbound connections per machine and stops lateral movement; a HIDS watches logs, file integrity and processes. See Firewalls and IDS/IPS and Network Segmentation.
Disk encryption, secure boot, TPM (concept)
- Full-disk encryption (BitLocker, FileVault, LUKS) protects data if a device is lost or stolen. Escrow recovery keys centrally.
- Secure Boot checks that the bootloader and kernel are signed, resisting boot-level malware.
- TPM is a hardware chip that stores keys and measures boot state, so disk keys are released only to an untampered system and credentials are bound to the device.
See Cryptographic Solutions and Operating System Security.
Mobile: MDM and MAM
- MDM (Mobile Device Management) manages the whole device: enforce passcode and encryption, push configs, locate, lock and remote wipe, require OS version.
- MAM (Mobile Application Management) manages only corporate apps and their data, which suits BYOD where you should not control the entire personal device.
- Containerisation or work profiles separate corporate from personal data. Combine with conditional access (only compliant devices reach company resources; see Identity and Access Management).
USB and removable media control
Block or restrict USB storage by policy, allow only approved or encrypted devices, disable autorun, and scan media. Removable media is a route for malware, data theft and crossing air gaps. Tie into DLP where available. Awareness matters too (see Social Engineering for dropped-USB attacks).
Privilege restriction
- Users should not run as local administrator day to day.
- Local admin password management (LAPS-style): give each machine a unique, random, regularly rotated local admin password stored centrally, so one stolen password does not unlock every device.
- Just-in-time elevation and separate admin accounts for administrators.
- These limit what malware can do and hinder lateral movement (Privilege Escalation).
Patching
Unpatched software is the most common way in. Keep the OS, browsers and third-party applications current, prioritised by exposure and exploitation. See Vulnerability and Patch Management.
Deployment and coverage pitfalls
- Coverage gaps: unmanaged, shadow, BYOD, legacy, and OT devices with no agent. Maintain an asset inventory and compare it against agent check-ins.
- Agent health: agents that are disabled, outdated or not reporting. Alert on silence and enable tamper protection.
- Exclusions: broad performance exclusions become hiding places for malware.
- Alert fatigue and no owner: tools in detect mode that nobody monitors; define who responds and when.
- Block mode never enabled after the pilot.
- Servers forgotten because "they are not user machines", or because of fear of performance impact.
- Offline and remote devices that never reach the update server; use cloud-managed agents.
- Over-reliance: EDR is not a substitute for patching, hardening, segmentation and backups (Backup and Disaster Recovery).
Key points
- Endpoint protection has moved from signature AV to behaviour-based EDR, with XDR/MDR adding correlation and managed response.
- EPP prevents, EDR detects and responds; both need someone watching.
- Layer allowlisting, host firewall, disk encryption, MDM/MAM, device control and least privilege.
- Measure coverage and agent health; blind spots are where attackers operate.
Hands-on
- YARA Rules: YARA mean one! (TryHackMe): writing pattern-based rules to detect malware indicators in files.
- C2 Detection: Command and Carol (TryHackMe): hunting command-and-control beaconing with Zeek logs and RITA. This is network-side telemetry rather than an endpoint agent, but shows the detection logic that XDR combines with endpoint data.