Plan
archived
EDR blind spots: 3 browser attack vectors that evade endpoint telemetry
- Engineer — Learn: A useful framing of why session-theft, malicious extensions, and in-browser manipulation leave no classic EDR artifacts — informs decisions about adding browser isolation or enterprise browser controls to the defense stack, but no immediate patch or config action required.
- SOC/IR — Plan: The coverage gaps described (no process creation, no file writes for browser-based session theft) are worth addressing this quarter by evaluating browser telemetry sources — proxy logs, enterprise browser audit events, or identity provider anomaly detection — to compensate for what EDR won’t surface.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.