| Detection | Device | Technique | Process chain | Severity | Response | Status | |
|---|---|---|---|---|---|---|---|
| EDR-2210 | WS-0571 | T1059.001 PowerShell | excel.exe → powershell.exe -enc … | High | Process killed, device isolated | Contained | |
| EDR-2208 | SRV-AFC-07 | T1003 credential dumping | unknown.elf reading /etc/shadow | Critical | Blocked by policy | Resolved | |
| EDR-2203 | WS-0388 | T1547 autostart | new Run key from %TEMP% | Medium | Key removed | Resolved |