Prioritize detections
Reviewed medium- and high-severity alerts, affected hosts, users, timestamps, and confidence scores.
CompletedSOC Alert TriageHands-On EDR Training
Endpoint Detection & Response Investigation
TryHackMe — Introduction to EDR
A practical SOC investigation of multiple endpoint detections using process lineage, command-line activity, file paths, network connections, indicators of compromise, MITRE ATT&CK context, and threat intelligence.
- Role
- SOC Analyst
- Environment
- TryHackMe EDR Simulation
- Scenario
- Introduction to EDR
- Status
- Completed
- Primary Tool
- EDR Console
01Scenario Overview
I worked as a SOC analyst at the simulated TECH THM organization with access to an EDR console containing multiple medium- and high-severity detections. The dashboard provided detection summaries, endpoint and user context, process trees, command lines, executable metadata, registry and network activity, IOC tables, confidence scores, and threat-intelligence labels.
The exercise focused on understanding and interpreting the visibility supplied by the EDR. Alert acknowledgement, containment, quarantine, and other response actions were outside the assigned scope.
02Investigation Objective
My objective was to reconstruct what happened on each endpoint and answer precise triage questions with supporting evidence. This required identifying the tool used to download a payload, locating suspicious files, validating an exfiltration destination, and using threat intelligence to understand a detected utility.
Detection summary + Process chain + Endpoint evidence + Network activity + Threat intel → Triage finding
03EDR Triage Workflow
Read the detection summary
Established what triggered each alert and identified the behavior that needed validation.
Trace the process chain
Followed parent-child relationships and command lines to reconstruct activity on the endpoint.
Inspect host evidence
Compared executable paths, signatures, hashes, file activity, and user context.
Review network activity
Examined destination domains, IP addresses, URLs, and the purpose of outbound connections.
Correlate IOCs
Connected file, domain, IP, hash, and URL indicators back to the process activity.
Check threat intelligence
Used the EDR threat-intelligence label to distinguish known internal software from suspicious activity.
Document findings
Recorded the evidence-backed answer for each alert without performing response actions.
04Detection Analysis
DESKTOP-HR01High
Office macro staged a downloaded payload
A macro-enabled invoice document opened in Microsoft Word spawned CMD, which launched cURL to download a payload. The file was written to the Public folder but was not executed.
Process / activity chain
WINWORD.EXE → CMD.EXE → cURL.EXE → INSTALL.EXE
Evidence-backed findings
- • Download utility: CURL.exe
- • Downloaded file: C:\Users\Public\install.exe
- • Source document: invoice.docm
- • External domain: ayebd.thm
- • External IP: 1.161.138.92
- • Execution was not observed; the behavior was consistent with payload staging.
MITRE / investigation context: Initial Access · T1566.001 — Spearphishing Attachment
WIN-ENG-LAPTOP03High
Suspicious service attempted data exfiltration
The investigation identified a suspicious syncsvc.exe running from a user Temp directory and communicating with an external file-transfer URL associated with an attempted dump-file upload.
Process / activity chain
Endpoint process activity → syncsvc.exe → outbound HTTPS upload
Evidence-backed findings
- • Suspicious binary: C:\Users\haris.khan\AppData\Local\Temp\syncsvc.exe
- • Exfiltration URL: https://files-wetransfer.com/upload/session/ab12cd34ef56/dump_2025.dmp
- • The Temp-directory location increased suspicion.
- • The destination path indicated an attempted upload of dump_2025.dmp.
MITRE / investigation context: Exfiltration · outbound transfer over a web service
DESKTOP-DEV01Medium
Update utility validated with threat intelligence
A detection involving UpdateAgent.exe required context from the EDR threat-intelligence panel before a conclusion could be reached.
Process / activity chain
Endpoint detection → UpdateAgent.exe → threat-intelligence validation
Evidence-backed findings
- • Threat Intel label: Known internal IT utility tool
- • The label supplied essential business context.
- • The alert demonstrated why severity and process names alone are not enough for classification.
MITRE / investigation context: Contextual validation · internal utility identification
05Indicators Correlated
C:\Users\Public\install.exe
Downloaded payload
ayebd.thm
External download source / C2 indicator
1.161.138.92
External download connection
9e107d9d372bb6826bd81d3542a419d6eaf1e3f5b94fc3b1f69413c5c30ef2e5
Unknown executable
C:\User\alice\Downloads\invoice.docm
Suspicious macro-enabled attachment
C:\Users\haris.khan\AppData\Local\Temp\syncsvc.exe
Suspicious Temp binary
https://files-wetransfer.com/upload/session/ab12cd34ef56/dump_2025.dmp
Attempted exfiltration destination
06Key Investigation Findings
Payload download
CMD.exe launched CURL.exe on DESKTOP-HR01, and the payload was saved as C:\Users\Public\install.exe.
Suspicious executable
syncsvc.exe was located at C:\Users\haris.khan\AppData\Local\Temp\syncsvc.exe on WIN-ENG-LAPTOP03.
Exfiltration attempt
The outbound upload targeted files-wetransfer.com and referenced dump_2025.dmp in the URL path.
Threat-intel context
UpdateAgent.exe on DESKTOP-DEV01 was labelled a known internal IT utility tool.
07Skills Demonstrated
EDR operations
- Detection triage
- Severity prioritization
- Host and user scoping
Process analysis
- Parent-child relationships
- Command-line review
- Executable path analysis
Evidence correlation
- File, hash, domain and IP IOCs
- Network activity
- Threat-intelligence context
Documentation
- Evidence-backed findings
- MITRE ATT&CK mapping
- Clear analyst notes
08Lessons Learned
Follow the full process tree
The process chain revealed how a trusted Office application led to CMD and cURL, exposing the actual download behavior.
File location matters
Public and Temp directories provided important context when evaluating downloaded or unfamiliar executables.
Network evidence shows intent
The complete destination URL made the attempted transfer and targeted dump file visible.
Context prevents poor conclusions
Threat intelligence showed that UpdateAgent.exe was an internal utility, demonstrating that an alert should not be judged by its name or severity alone.
09Training Context
This case study documents hands-on work completed in the TryHackMe Introduction to EDR room within a controlled simulation. It demonstrates my investigation method and understanding of EDR telemetry; it is not presented as production SOC employment.
The indicators shown here belong to the training scenario. In a live environment, I would preserve evidence, document confidence and impact, follow the organization’s escalation procedure, and coordinate authorized containment and remediation.