Endpoint: Evidence & Entity Investigation

Evidence-based investigation

Entity types in MDE

Each entity type has its own investigation page:

Entity	Investigation Page Shows	Key Questions
File	Hash, prevalence, first/last seen, VirusTotal results, related alerts	Is this file malicious? How many devices have it?
Process	Command line, parent process, child processes, network activity	What did this process do? Who launched it?
IP Address	Geolocation, ASN, reputation, devices that connected to it	Is this a C2 server? Which devices talked to it?
URL/Domain	Reputation, associated alerts, devices that accessed it	Is this a phishing site? How many users visited?
User Account	Sign-in history, devices used, alerts involving this account	Is this account compromised? What did it access?
Device	Full timeline, installed software, vulnerabilities, related alerts	What happened on this device? Is it compromised?

File entity investigation

When investigating a suspicious file:

1. Check the file hash — look it up in VirusTotal, Microsoft TI, or your internal TI feeds
2. Check prevalence — how many devices in your org have this file? If it is on one device, it is more suspicious than if it is on 1,000 (common software)
3. Check first/last seen — when did this file first appear? Did it arrive via email, download, or USB?
4. Check related alerts — has this file triggered alerts on other devices?
5. Check behaviour — what did the file do when executed? (process tree, network connections, file writes)

Process tree analysis

The process tree shows the parent-child relationship of processes:

explorer.exe
  └── outlook.exe
        └── winword.exe (opened email attachment)
              └── powershell.exe (macro executed)
                    └── update.exe (payload downloaded)
                          └── cmd.exe (lateral movement attempt)

Tracing the process tree reveals the attack chain: which legitimate process was abused, what the attacker executed, and how deep the compromise goes.

💡 Scenario: Tyler traces a process tree

Tyler at CipherStack investigates an alert: “Suspicious process creation from Office application.”

Process tree:

• outlook.exe → opened an attachment
• winword.exe → macro enabled by user
• powershell.exe → -enc aQBlAHgA... (Base64-encoded command)
• certutil.exe → downloaded update.exe from external URL (LOLBin technique)
• update.exe → connected to C2, then spawned cmd.exe for reconnaissance

Tyler identifies:

• Initial vector: Email attachment with macro
• Execution technique: PowerShell + certutil (living-off-the-land)
• Persistence: Not yet — Tyler catches it before the attacker establishes persistence
• Response: Quarantine update.exe, block the C2 domain, purge the email across mailboxes

Investigating attack disruption incidents

When you open an incident that automatic attack disruption handled, you see:

What disruption already did

Disruption Action	What It Means for Investigation
Device contained	The device is isolated — you can still investigate via timeline and live response
User suspended	The account is disabled in Entra ID — check what the account did before suspension
Attack stopped	The spreading mechanism (ransomware, BEC) was interrupted

Your role after disruption

1. Verify the disruption was correct — was the right device/user contained? Any false positive?
2. Complete the investigation — disruption stops the immediate threat but does not find the root cause
3. Check for gaps — did the attacker access other systems before disruption? Is there persistence on other devices?
4. Remediate fully — reset passwords, remove persistence, patch vulnerabilities
5. Release contained entities — once investigation is complete, uncontain devices and re-enable accounts

💡 Exam tip: disruption does not equal resolution

The exam tests whether you understand that attack disruption is containment, not resolution. After disruption:

• The incident is still Active (not resolved)
• Investigation must continue to identify root cause
• Persistence mechanisms may exist on undisrupted devices
• The attacker may have exfiltrated data before disruption kicked in

If a question asks “what should the analyst do after attack disruption contains a device?” — the answer is continue investigating, not close the incident.

Question

What six entity types can you investigate in Defender for Endpoint?

Click or press Enter to reveal answer

Answer

1. File (hash, prevalence, related alerts). 2. Process (command line, parent/child, network activity). 3. IP Address (geo, reputation, connected devices). 4. URL/Domain (reputation, accessing devices). 5. User Account (sign-in history, alerts). 6. Device (full timeline, vulnerabilities).

Click to flip back

Question

What does the process tree show and why is it important?

Click or press Enter to reveal answer

Answer

The process tree shows parent-child relationships between processes — which process launched which. It reveals the attack chain: a legitimate process (e.g., Word) spawning a suspicious child (e.g., PowerShell) indicates a macro-based attack. Tracing the tree from the initial process to the deepest child maps the full execution chain.

Click to flip back

Question

After automatic attack disruption contains a device, is the incident resolved?

Click or press Enter to reveal answer

Answer

No. Attack disruption is containment, not resolution. The incident remains Active. The analyst must: verify the disruption was correct, continue investigating the root cause, check for gaps (other compromised systems), remediate fully, and only then release contained entities and close the incident.

Click to flip back

Knowledge Check

An investigation package shows that `certutil.exe` was used to download a file from an external URL. What type of attack technique is this?

ALiving-off-the-land — using a legitimate Windows tool for malicious purposesBBrute force — certutil is cracking passwordsCSQL injection — certutil is querying a databaseDPhishing — certutil sent a deceptive email

Check Answer

Knowledge Check

Automatic attack disruption contained a ransomware-infected device at Atlas Bank. Elena opens the incident and sees the device is isolated. What should she do next?

AClose the incident — the threat has been containedBImmediately release the device from isolation so users can workCContinue the investigation — check for persistence, lateral movement to other devices, and data exfiltration before disruptionDDisable attack disruption to prevent future business interruptions

Check Answer

Next up: Endpoint investigation complete. The last piece of Domain 2 — investigating Microsoft 365 activities using Purview Audit, Content Search, and Graph activity logs.