EDR Evasion and Telemetry Integrity Response (Syscall/Unhook/ETW-AMSI)
Executes triage, telemetry recovery, isolation, memory-based implant cleanup, and durable hardening when EDR hook removal, ETW/AMSI patching, or telemetry interruption is detected on an endpoint.
Prepare
7 steps- Sysmon 13+ and event coverage validation
Periodically confirm that Sysmon is installed and generating EID 4 (service state), EID 7 (ImageLoad), EID 8 (CreateRemoteThread, with the `StartModule` field), EID 10 (ProcessAccess, with the `CallTrace` field), EID 16 (configuration change), and EID 25 (ProcessTampering) events
- Telemetry silence rule (DR-8) deployment status
Verify that an absence/threshold rule detecting a sudden drop in the Sysmon event stream from an endpoint is active in SIEM and calibrated with an environment-specific threshold (minimum events/minute, lookback period); this playbook depends on the DR-8 live rule
- EDR agent tamper protection and PPL status
Verify from the management console that the enterprise EDR agent's tamper protection feature protecting its own process and driver from modification is enforced; confirm the agent process runs in PPL (Protected Process Light) status and can subscribe to the ETW Threat Intelligence provider
- PE-sieve / Velociraptor artifact readiness
Confirm that `pe-sieve.exe` or the Velociraptor `Windows.Detection.PESieve` artifact is ready for use in the IR toolkit; document artifact parameters (`--imp_rec 3 --check_ep`) in the environment approval
- BYOVD hash blocklist currency
Verify that known vulnerable driver hashes from loldrivers.io and the Microsoft Vulnerable Driver Blocklist have been added to the EDR and WDAC/HVCI policy and are current