Endpoint Security Guide: EDR, XDR, EPP and Hardening

Laptops, desktops and servers are where attackers run code, steal credentials and disable defences, so an endpoint security stack that only matches known malware leaves most of an intrusion unseen. Modern endpoint security combines prevention (antivirus, application control, attack surface reduction, device control, encryption), detection (EDR telemetry and behavioural analytics) and response (isolation, live response and forensic collection), and it depends on hardening and identity controls that make the agent hard to switch off. This guide explains how EPP, NGAV, EDR, XDR and host-based intrusion prevention fit together, which settings matter, how to roll them out without breaking the business, and how to measure whether they work. It uses Microsoft's documented Windows and Defender features as worked examples because they are widely deployed and publicly documented; other platforms have equivalents. It is written for endpoint engineers, SOC leads and security architects choosing or replacing endpoint tooling.

Key takeaways

• Prevention and detection are different jobs. EPP and NGAV stop known and suspicious code before it runs; EDR records what happened so analysts can find and contain what prevention missed. You need both.
• Application control is the strongest single prevention control. Moving from "run unless known bad" to "run only if allowed" removes whole classes of attack, but needs an audit phase and an owner for exceptions.
• Tamper resistance decides whether the stack survives an attacker with admin rights. Removing local administrator rights, rotating local admin passwords and locking agent settings matter as much as detection quality.
• Response actions need rehearsal. Host isolation, live response and evidence collection have caveats (VPN tunnels, proxies, hypervisor hosts) that you want to discover in a drill, not an incident.
• The endpoint management plane is a privileged identity. Whoever controls the EDR console or device management tool can disable protection or wipe the fleet, so protect those accounts and tokens like domain administrators.

The endpoint security stack: EPP, NGAV, EDR, XDR and HIPS

These category names come from the market, not a standard, and products overlap. Judge capabilities, not labels.

NIST SP 800-94 treats host-based IDPS as one of four IDPS classes alongside network-based, wireless and network behaviour analysis. Microsoft describes its own XDR suite as "a unified pre- and post-breach enterprise defense suite" coordinating detection and response "across endpoints, identities, email, and applications", which is a fair description of what the XDR label promises.

Prevention controls that change the outcome

Scanning and behaviour monitoring

• On-access scanning: scans files as they are opened, written or executed. In Microsoft Defender Antivirus this is real-time protection, set to "bi-directional (full on-access)", combined with behaviour monitoring and heuristics. Microsoft states that disabling real-time protection "drastically reduces the protection on your endpoints".
• On-demand scanning: scheduled or triggered quick and full scans. Useful after a signature update, during incident response, and for removable media, but never a substitute for on-access scanning.
• Third-party antivirus alongside the built-in engine: where a third-party product is primary, the built-in engine usually runs in passive mode without on-access scanning. Features such as Microsoft's EDR in block mode let EDR detections still be remediated in that configuration, but attack surface reduction rules and network protection need the built-in engine in active mode.

Attack surface reduction and exploit protection

Attack surface reduction (ASR) rules block specific behaviours that malware relies on, rather than specific files. They map closely to ATT&CK mitigation M1040 (Behavior Prevention on Endpoint). Each rule can run in Audit, Block or Warn mode (not every rule supports Warn).

Application control

Microsoft summarises application control as changing Windows "from a place where all code runs unless your AV solution confidently predicts it's bad, to one where code runs only if your policy says so". On Windows there are two technologies. App Control for Business (formerly Windows Defender Application Control) applies to the whole device, can restrict kernel drivers, scripts and MSI installers, and is serviced as a security feature. AppLocker supports per-user and per-group rules but, in Microsoft's words, "doesn't meet the servicing criteria for being a security feature". The usual pattern is App Control as the device-wide baseline with AppLocker only where shared devices need user-specific rules. Allowlisting is also why CIS Controls include safeguards 2.5, 2.6 and 2.7 (allowlist authorised software, libraries and scripts). See the AI Coding Agents Security Guide for the growing set of agent tools on developer endpoints that an allowlist must account for.

Device control, encryption and host firewall

• USB device control: allow, deny or audit removable storage, printers and Bluetooth by device, vendor and product ID, user group or file type. A common policy allows only encrypted removable drives. Disabling autorun and autoplay (CIS safeguard 10.3) is the minimum.
• Endpoint encryption: full-volume encryption such as BitLocker protects data on lost or stolen devices. TPM plus PIN gives pre-boot multi-factor protection; TPM-only is transparent but weaker against physical attacks. Confirm recovery keys are escrowed to Active Directory or Entra ID before relying on them.
• Host firewall: block inbound SMB, RDP and WinRM to workstations except from management hosts. Workstation-to-workstation traffic is rarely needed and is a common lateral movement path (CIS safeguard 4.5).

Hardening, configuration management and tamper resistance

An attacker with local administrator rights can stop services, add exclusions and load drivers. Hardening reduces how often they get those rights and how much they can do with them.

• Secure configuration baseline: deploy a documented baseline (CIS Benchmarks, Microsoft security baselines or NCSC device guidance) through your management tool, and report drift. This is CIS safeguard 4.1 and NIST CSF 2.0 PR.PS-01.
• Tamper protection: lock antivirus and EDR settings so local administrators and Group Policy cannot turn off real-time protection, behaviour monitoring or cloud protection, or add exclusions. Microsoft notes that blocked changes "might appear to succeed" and that tampering attempts "typically indicate that a larger cyberattack has taken place". Check status with Get-MpComputerStatus | Select-Object IsTamperProtected.
• Remove standing local admin rights: users should not be local administrators. Use an elevation tool or a just-in-time process for the exceptions.
• Unique local administrator passwords: a shared local administrator password turns one compromised laptop into the whole fleet. Windows LAPS rotates each device's local administrator password and backs it up to Entra ID or Active Directory (one or the other, not both).
• Patch and remove: keep the operating system, browsers and the agent itself current, and uninstall software nobody owns (CIS safeguards 2.2 and 2.3; CSF PR.PS-02). See the Privileged Access Management Guide for admin workstation and elevation patterns.

Endpoint telemetry, threat hunting and IOC sweeps

EDR value comes from the telemetry it keeps. When evaluating or tuning, confirm the agent records at least the following, and for how long:

• Process creation with full command line, parent process, user, integrity level and file hash.
• Network connections per process, and DNS queries.
• File and registry changes in persistence locations (Run keys, services, scheduled tasks, WMI subscriptions, startup folders).
• Process access and injection, especially handles opened to LSASS.
• Driver and module loads, which reveal vulnerable driver abuse.
• Logon events and the account behind each action.

Where EDR is absent or retention is short, Sysmon fills many gaps in the Windows event log: event 1 (process creation), 3 (network connection), 6 (driver loaded), 10 (ProcessAccess), 13 (registry value set) and 22 (DNS query). Microsoft notes that Sysmon "does not provide analysis of the events it generates", so it needs a SIEM. For identity-centred detections built on endpoint and logon signals, see the ITDR Guide.

• Threat hunting: start from hypotheses tied to ATT&CK techniques (for example, Office spawning a script host, or unsigned binaries in user profile folders) and run them across all endpoints on a schedule, not only during incidents.
• IOC sweeps: when a new advisory lands, search historical telemetry for its hashes, domains, file paths and command lines. A sweep is only as good as retention: 30 days of telemetry cannot clear a 90-day-old campaign.
• Detection events to forward: antivirus detections and failures (Defender events 1116, 1117, 1119), protection being disabled or reconfigured (5001, 5007) and tamper protection blocking a change (5013) from the Microsoft-Windows-Windows Defender/Operational log, plus App Control blocks (3077 enforced, 3076 audit) from CodeIntegrity/Operational.

Response: host isolation, live response and endpoint forensics

Isolation contains; it does not evict. Before releasing a host, reset credentials used on it, check for persistence, and decide whether to reimage. Credentials cached or typed on a compromised endpoint should be treated as exposed. See the Leaked Credential Response Playbook.

Agent-based versus agentless endpoint security

Agentless scanning, offered by cloud security platforms, takes snapshots of virtual machine disks and analyses them out of band for vulnerabilities, software inventory, plain-text secrets and malware. It needs no agent and has no performance impact, but it is point-in-time: it cannot see process behaviour, block execution or isolate a host.

• Choose agents for user endpoints, servers holding sensitive data or credentials, domain controllers and anything that needs blocking or response actions.
• Use agentless for broad cloud coverage, short-lived or third-party-managed workloads where installing an agent is impractical, and as a check on which machines are missing an agent.
• Combine them: agentless discovery reporting "no EDR installed" is a cheap coverage control.

Choosing, replacing and sizing EDR and XDR

When evaluating a new platform or replacing an incumbent, test against your own environment rather than vendor scores.

• Operating system coverage: Windows, macOS, Linux, legacy server versions and virtual desktops, with feature parity stated per platform. Hybrid estates often discover that Linux or older Windows Server builds lack isolation or prevention.
• Telemetry retention and query: how many days of raw telemetry are searchable, at what cost, and whether you can export it to your SIEM.
• Correlation quality (XDR): which identity, email, cloud and network sources are natively correlated into incidents, and which third-party sources are only ingested as raw logs.
• Response breadth: isolation on every OS, live response controls, automated actions and their approval model.
• Tamper resistance: behaviour when a local administrator or a vulnerable driver tries to stop the agent, and how fast the console alerts.
• Migration plan: run the new agent in detection-only mode alongside the old one, confirm exclusions do not conflict, and keep the old product until coverage reports match the asset inventory.

Small organisations (no 24x7 SOC) get more from strong prevention, application control and a managed detection and response service than from a powerful EDR nobody watches. Large organisations should prioritise telemetry retention, API access for automation, role-scoped administration across business units, and XDR correlation with the identity provider.

Rolling out endpoint security

1. Inventory first. Reconcile the asset inventory against the EDR console and device management (CIS safeguard 1.1, CSF ID.AM-01). Unmanaged devices are the gap attackers use.
2. Deploy the agent in detection mode to a pilot ring of IT staff and representative business users, then to 10% of each device type.
3. Turn on tamper protection and LAPS as soon as agents are stable; these carry little compatibility risk.
4. Run ASR rules and application control in audit mode for two to four weeks. Review audit events (ASR audit events, App Control 3076, AppLocker 8028) and build exceptions from evidence.
5. Enforce in rings: IT, then low-risk business units, then high-dependency teams, with a named owner approving each exception.
6. Remove local admin rights once an elevation route exists for legitimate needs.
7. Rehearse response: isolate, collect and release a test device on each OS and network path (office, VPN, home).
8. Roll back by policy, not by uninstall: keep each enforcement change in its own policy so a problem rule can be returned to audit mode for one ring without removing protection.

Where identity fits

Endpoint security is full of identities that attackers target. Local administrator accounts, the service accounts that run agents and management tools, API tokens used to integrate the EDR with SIEM and SOAR platforms, and the cloud admin accounts that control device management can each switch off or misuse the whole stack. In the Stryker Intune wiper attack, a compromised administrator account used the legitimate remote wipe command, with no malware on the endpoints. Scope management roles so no single role can act on the entire fleet, require approval for bulk destructive actions, store integration tokens in a vault and rotate them. See the Service Account Security Guide and the API Key Management Guide.

Measuring endpoint security

• Agent coverage: percentage of inventoried endpoints with a healthy, reporting agent, by OS and business unit (target close to 100%, with named exceptions).
• Prevention posture: percentage of endpoints with tamper protection on, ASR rules in block mode and application control enforced.
• Local admin exposure: number of users with standing local admin rights, and percentage of devices with LAPS-managed passwords.
• Encryption coverage: percentage of portable devices encrypted with recovery keys escrowed.
• Detection and response speed: mean time from EDR alert to triage, and from confirmed compromise to isolation.
• Tamper signals: count of protection-disabled and tamper-blocked events per month, each investigated.

See the Identity Security Metrics Guide.

Framework mapping

For threat mapping, ATT&CK mitigation M1040 (Behavior Prevention on Endpoint) lists techniques such as T1059 (Command and Scripting Interpreter), T1055 (Process Injection), T1003.001 (LSASS Memory) and T1486 (Data Encrypted for Impact). Agent tampering maps to T1685 (Disable or Modify Tools) and malicious services and drivers to T1543.003.

Common failure patterns

• EDR without tamper protection: attackers with admin rights disable or blind the agent. Storm-0501 tampered with security products and installed remote management tools such as AnyDesk during its intrusions, as described in the Storm-0501 hybrid cloud attack. Lock settings, alert on protection-disabled events and treat a silent agent as an incident.
• Coverage gaps hidden by dashboards: the console reports 98% healthy, but it only counts devices that enrolled. Servers built from old images, Linux hosts and contractor laptops are missing. Always measure against the asset inventory.
• Permanent audit mode: ASR and application control deployed in audit "temporarily" and never enforced. Set an enforcement date at the start of the pilot.
• Broad exclusions: whole folders, file shares or developer tool paths excluded to fix performance. Attackers stage tools in exactly those paths. Exclude by specific process and path, review quarterly.
• Unrestricted remote access software: legitimate remote monitoring and management tools give attackers persistence that EDR treats as normal. Allowlist the approved tool and block the rest.
• An over-powered management plane: one console administrator able to wipe or unprotect every device, without approval, as the Stryker incident showed.

Practitioner checklist

• Reconcile EDR and device management enrolment against the asset inventory every week and chase every gap.
• Run on-access scanning, behaviour monitoring and cloud protection on every endpoint, with tamper protection on.
• Deploy ASR rules and application control in audit mode with a fixed enforcement date, then enforce in rings.
• Remove standing local admin rights and manage local administrator passwords with LAPS or equivalent.
• Encrypt all portable devices and confirm recovery key escrow; allow only encrypted removable media.
• Block inbound SMB, RDP and WinRM between workstations with the host firewall.
• Forward protection-disabled, tamper-blocked and application control block events to the SIEM and alert on them.
• Keep searchable telemetry long enough to run IOC sweeps for current advisories, and test that you can.
• Rehearse isolation, evidence collection and release on every OS and network path each quarter.
• Scope endpoint management and EDR admin roles, require approval for bulk destructive actions, and vault integration tokens.

Standards and references

• NIST: SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
• NIST: SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)
• NIST: The NIST Cybersecurity Framework (CSF) 2.0
• CIS: Control 10, Malware Defenses
• MITRE ATT&CK: M1040 Behavior Prevention on Endpoint
• NCSC: Device Security Guidance
• Microsoft: App Control for Business and AppLocker overview
• Microsoft: Take response actions on a device

Related NHI Mgmt Group resources: Privileged Access Management Guide · ITDR Guide · Service Account Security Guide · Zero Trust Identity Guide