SENSOR RADAR // EDR TELEMETRY & BLIND-SPOT INSPECTOR

What Does The EDR See?

INSPECTION SENSORS:SYSMON//SEC.EVTX//ETW-TI//NTDLL HOOKS

When operators execute commands during penetration testing or adversary emulation, every keystroke triggers a chain reaction through user-mode API hooks (ntdll.dll), kernel driver callbacks (PsSetCreateProcessNotifyRoutineEx), Event Tracing for Windows (EtwTI), and security event logs. Use this interactive workbench to inspect the exact sensor footprint, evaluate detection risk scores, uncover blind spots, and extract defensive hunting queries.

MONITORED SENSORS

5 LAYERS (HOOKS → KERNEL)

PRESET TECHNIQUES

12 CRITICAL VECTORS

CUSTOM ENGINE

REAL-TIME PARSER

DATA LEAKAGE RISK

0% (100% IN-BROWSER)

1. Select Technique Preset

13 PRESETS

2. Or Run Custom Command Inspector

HEURISTIC SENSOR ENGINE // 100% CLIENT-SIDE PARSER

Credential AccessLSASS Memory Minidump via Comsvcs.dll(T1003.001)

Abuses the built-in Microsoft COM+ Services DLL (comsvcs.dll) exported MiniDump function to dump the Local Security Authority Subsystem Service (lsass.exe) memory space without dropping a standalone compiler or compiled tool.

DETECTION RISK

98/ 100

CRITICAL

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 684 C:\Windows\Temp\lsass.dmp full

WINDOWS EVENT LOGS

Security.evtx

Event ID 4688Event ID 4656Event ID 4663

Critical Monitored Fields:

ProcessNameSpawns under current user / admin context

C:\Windows\System32\rundll32.exe

CommandLineDirect command-line string matching in SIEM

*comsvcs.dll*MiniDump*full*

TokenElevationTypeRequires SeDebugPrivilege privilege elevation

TokenElevationTypeFull (2)

SYSMON TELEMETRY

Operational

Event 1 (ProcessCreate)Event 10 (ProcessAccess)Event 11 (FileCreate)

Sysmon Event 10 will immediately log rundll32.exe requesting PROCESS_VM_READ (0x0010) and PROCESS_QUERY_INFORMATION (0x0400) or 0x1FFFFF against SourceImage: rundll32.exe -> TargetImage: C:\Windows\System32\lsass.exe.

Captured Event Payload:

SourceImage:C:\Windows\System32\rundll32.exe

TargetImage:C:\Windows\System32\lsass.exe

GrantedAccess:0x1fffff (PROCESS_ALL_ACCESS)

CallTrace:C:\Windows\SYSTEM32\ntdll.dll+...|C:\Windows\System32\comsvcs.dll+0x31a20

EDR KERNEL & HOOKS

Sensor Engine

Hooked User-Mode APIs (ntdll.dll):

NtOpenProcessNtReadVirtualMemoryMiniDumpWriteDump

Kernel Driver Callbacks:

ObRegisterCallbacks (Process Handle creation filter)PsSetCreateProcessNotifyRoutineEx

ETW Event Providers:

Microsoft-Windows-Threat-Intelligence (EtwTI ProcessAccess)Microsoft-Windows-Kernel-Process

CrowdStrike IOA / SentinelOne Flag:

SuspiciousLSASSAccessByUncommonProcess (rundll32.exe accessing lsass.exe)

THE EDR TELEMETRY STACK EXPLAINED

1. User-Mode API Hooking

EDR injects its sensor DLL into every spawned process, patching early instructions in ntdll.dll (e.g. NtOpenProcess, NtAllocateVirtualMemory) with JMP redirects to analyze arguments before delegating to the kernel.

2. Kernel Callbacks & ObRegister

EDR kernel drivers register with Windows kernel routines (PsSetCreateProcessNotifyRoutineEx,ObRegisterCallbacks). These intercept process creation and handle access at ring-0 regardless of user-mode unhooking.

3. ETW-TI (Threat Intelligence)

Kernel-level Event Tracing for Windows emits protected telemetry for process injection, memory allocation, and suspicious API usage directly to authorized EDR antimalware services (ELAM signed), bypassing userland tampering.

Need full detection engineering coverage across enterprise environments?

Tradecraft Lab (Sigma & LOLBAS)Rule Packs Store