EDR Behavioral Alert Chain Reconstruction
An EDR platform raised a PowerShell alert. Engineers dug deeper with AVL Code, reconstructing a five-level process call chain and uncovering a DNS covert channel and LotL techniques.
Built with AVL Code + the Landi model
Overview
Starting from a single PowerShell alert on an EDR platform, this deep behavioral analysis correlated parent-child processes, identified a DNS covert channel and triaged Living-off-the-Land attack patterns to reconstruct the full five-level call chain from winlogon down to PowerShell — exposing systemic gaps in parent-process trust scoring, DNS covert-channel detection and automated response policy.
Key results
- Confirmed a DNS-over-TXT covert channel plus LotL attack with high confidence, ruling out a false positive
- Reconstructed the complete five-level PowerShell process call chain
- Pinpointed the true malicious entry point via missing signatures, non-system files and unknown detection status
- Decoded the full PowerShell command, identifying bypass techniques and look-alike domains
- Mapped the activity precisely to MITRE ATT&CK T1059.001 and T1572
Technical highlights
Practical value
Helps security operations trace the root causes of false positives and misses and tune response policies, gives threat-intelligence teams IOC and TTP material ready for ingestion, guides EDR/AV engine teams in strengthening signature validation, compile-time anomaly detection and behavioral rules, and gives management a quantifiable view of risk and security ROI.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model