Endpoint Patching & EDR Alerts

What Is Endpoint Patching & EDR Alerts?

An EDR alert flashes in the system tray: a process launched from a macro-enabled spreadsheet tried to read credential memory, and the status says Partially Blocked, not blocked. This exercise walks you through the EDR portal to see what that means: the alert details, the behavioral indicators, and a critical patch that has sat pending for three days. Stolen credentials are already being tried against your account. You install the update through Windows Settings and file a full incident report.

What You'll Learn in Endpoint Patching & EDR Alerts

• Read an EDR alert's details and behavioral indicators, such as credential-memory access, hidden PowerShell, and unknown outbound connections
• Recognize that a Partially Blocked alert means real damage may have occurred, and respond by patching and reporting
• Verify your device's patch status and install a pending critical security update through the operating system's update settings
• Escalate genuine EDR alerts through proper channels with accurate information about what you observed
• Understand why endpoint patching reduces your organization's attack surface by closing the known vulnerabilities that exploit kits are built to target

Endpoint Patching & EDR Alerts — Training Steps

1. Introduction

   Today, you will learn how Endpoint Detection and Response (EDR) systems monitor your workstation for threats - and what to do when they detect something suspicious.

2. A Routine Thursday

   It's Thursday afternoon. Alice is finishing up a quarterly analysis report when an unusual notification catches her eye in the system tray. A small shield icon is flashing amber - the company's EDR agent is trying to get her attention.

3. The EDR Alert

   Here is what the EDR alert means: Sentinel Shield EDR - Alert Severity: High Type: Suspicious Process Behavior Details: A process attempted to access sensitive memory regions. This behavior pattern is associated with credential harvesting tools. Status: Partially Blocked: Immediate Action Required Recommended: Review alert details, install pending security update, and report incident.

4. Logging into the EDR Portal

   Clicking 'View Details' opened the Sentinel Shield EDR portal in Alice's browser. She needs to log in to review the full alert details and her endpoint's protection status.

5. The EDR Dashboard

   The EDR portal dashboard shows Alice's workstation status at a glance: Endpoint Status: Protected Last Scan: Today, 2:30 PM Threat Detected: 1 (Today), Partially Blocked Agent Version: 8.2.1 (Current) Patch Status: 1 Update Pending Critical Security Update KB5035853 available Pending since: 3 days ago Alice notices the alert status says 'Partially Blocked', not fully blocked. The missing security update gave the attacker a brief window of access.

6. Alert Details

   The alert details reveal what happened: Alert ID: EDR-2024-847291 Detection Time: Today, 2:47 PM Status: Partially Blocked Process: svchost_update.exe (Suspicious name mimicking legitimate process) Source: Downloaded file: 'Q3_Budget_Summary.xlsm' macro execution Behavioral Indicators: Attempted to access LSASS memory (credential storage) Spawned hidden PowerShell process Attempted network connection to unknown external IP Action Taken: Process terminated after partial execution: credentials may have been exposed Alice feels a chill. The process wasn't just blocked: it ran long enough to potentially harvest her credentials before EDR killed it.

7. Patch Status Review

   The patch status page shows: Operating System Patches: KB5035853 (Critical Security Update): PENDING, 3 days KB5034123 (Feature Update): Installed KB5033891 (Security Update): Installed The pending critical update (KB5035853) patches vulnerability CVE-2024-26169, a Windows Error Reporting Service flaw that lets code already running as a normal user elevate itself to SYSTEM: the exact privilege escalation used in today's attack once the macro ran. Because this patch was pending for 3 days, the vulnerability was open when the attacker struck. EDR caught the malicious behavior, but the missing patch is why credentials were partially exposed. Alice notices there is no install button here: EDR monitors patch status, but patches are installed through Windows Settings .

8. The Consequences

   While Alice is reviewing the patch information, a new email arrives. The subject line makes her stomach drop. IT Security has detected suspicious login attempts on her account from an unrecognized IP address in Eastern Europe, within the last 15 minutes. The credential exposure from the EDR alert wasn't theoretical: someone is already trying to use her compromised credentials.

9. Knowledge Check

10. Installing the Patch

    Following IT Security's instructions, Alice opens Windows Settings to install the critical security update that has been pending for 3 days. This is how OS patches are actually installed: through your operating system's update settings, not through the EDR portal.