CyCube
Intermediate

Endpoint Logs Detection

Use endpoint logs and EDR telemetry to detect threats: anomalies, LOLBAS, suspicious Office activity, ransomware indicators, and incident handling fundamentals.

Duration
4h 55m
Labs
6
Videos
11
Quizzes
2

Skills Acquired

  • Understand endpoint log fundamentals and detection methods
  • Identify anomalies and baseline deviations
  • Detect potentially unwanted applications (PUAs)
  • Analyze LOLBAS and EDR telemetry for malicious behavior
  • Use antivirus and system logs to correlate threat activity

Curriculum

  1. Initial Threat Detection
    • Detecting initial threats
    • Response and timeline analysis
    • Baseline and anomaly detection
  2. Incident Management and Mitigation
    • Incident handling methods
    • Suspicious Office file investigation
    • Potentially unwanted applications
    • Ransomware and outbreak management
  3. Threat Identification
    • LOLBAS detection techniques
    • Threat hunting and intelligence
    • Antivirus and EDR log correlation

Included in these pathways