Endpoint Records Describe Activity, Not Motive

Endpoint Records Describe Activity, Not Motive

Use host relationships without turning parentage, tool names, or sensor output into unsupported causality.

Process, file, configuration, and session evidence need cautious interpretation

An endpoint sensor reports that a document reader created a command interpreter, which then created an archive. The chain deserves attention, but each statement is still an observation produced by a sensor. It does not by itself tell you whether code injection occurred, whether the user initiated the action, or whether the archive contains sensitive data.

Process parentage records which process the operating system or sensor identifies as the creator. Ancestry follows that relationship through earlier processes. Causality is a stronger claim: one action produced another outcome. Parentage can support a causal hypothesis, but wrappers, brokers, scheduled tasks, service managers, and injection can make the recorded parent different from the meaningful initiator.

Identity and session context help. The same command under an interactive user session means something different from a service account during a maintenance window. File creation can show path, type, hash, and writer; configuration records can show persistence or policy change; memory evidence can reveal loaded code. Each source adds a perspective. None should be stretched beyond its vantage point.

Living-off-the-land illustrates the problem. Administration tools are useful to both defenders and attackers. A tool name is an adversary-controlled feature and often a weak foundation. The more durable question is what state the tool changed, which authority it used, which resources it touched, and how that behavior fits the surrounding sequence.

Sensor trust also matters. A compromised host can disable collection, tamper with records, or create disagreement among sources. Evidence that the sensor stopped, a policy exclusion appeared, or network activity continued after host telemetry ended can be security-relevant in its own right. The ATT&CK distinction between Stealth and Defense Impairment helps separate hiding activity from weakening visibility; The Stealth and Defense Impairment Tactics in ATT&CK v19 provides the current context.

A strong endpoint alert gives the analyst the process and session relationships, relevant state changes, source health, and alternative explanations. It does not translate a suspicious chain into certainty. The value of endpoint evidence is its detail. The discipline is remembering who observed that detail and what remains outside the observation.

Resources

• MITRE ATT&CK Enterprise Techniques — Primary reference for the standards and concepts discussed in this lesson.