When Your EDR Says Clean but You Know Something Is Wrong: A Threat Hunter's Manual Checklist

Understanding why your EDR missed something is as important as finding what it missed. EDR detection logic falls into two categories: signature-based (matching known bad file hashes, known C2 domains, known malware strings) and behavioral (identifying patterns of activity that indicate malicious intent regardless of the specific tool used).

Signature gaps are obvious: new malware or custom tooling that has never been seen before will not match any signature. Less obvious are the behavioral gaps.

Behavioral detection thresholds are tuned to reduce false positives. An attacker who adds a 30-second sleep between commands, who limits credential access attempts to three per hour, who uses WMI instead of PowerShell because your EDR has tighter PowerShell coverage, and who keeps their C2 beacon interval at 2 hours instead of 5 minutes can operate below the noise floor of behavioral detection.

Living-off-the-land techniques use legitimate Windows binaries (certutil, mshta, regsvr32, wscript, msiexec) that your EDR must handle carefully to avoid false positives in environments where these tools are used legitimately. An attacker who certutil-decodes a payload hosted at a legitimate URL can look indistinguishable from a software deployment script.

Memory-only threats that never write to disk have no file hash to signature-match and limited disk forensic artifacts. Process injection techniques that run malicious code inside a legitimate process (explorer.exe, svchost.exe) may generate a behavioral alert or may not, depending on the specific injection method and your EDR's coverage of that technique.

Before you begin manual investigation, document the specific anomaly that triggered your concern. This matters because it determines where you start and what you are looking for.

Common starting signals and what they suggest:

Unusual outbound network connection: Start with network investigation (DNS lookups, connection timing, data volume). The anomaly may be C2 beaconing or data staging for exfiltration.

Canary token fired: Start with the specific user account and host that accessed the token. Look for lateral movement from that account.

Authentication anomaly (login from unusual location, unusual time): Start with the specific account. Look for actions taken after the anomalous login.

User-reported unexpected behavior (browser redirect, application crash, unexpected admin prompt): Start with the specific endpoint. Look for recently installed software, scheduled tasks, and persistence mechanisms.

SIEM alert that fired once and not again: May indicate a single exploitation event or a test probe. Look for actions in the 30-minute window around the alert timestamp.

File integrity monitoring alert on a system file: Start with the specific file. Verify the hash against known-good versions. Look for processes that wrote to that path.

Attackers establish persistence so they survive reboots and maintain access even if the initial access vector is patched. Check all of the following on any host you are investigating.

Scheduled Tasks: On Windows, run: schtasks /query /fo LIST /v | findstr /i "task name|run as|task to run" Look for tasks with names that do not match any known software, tasks that run at unusual times (3-5 AM), tasks that execute scripts from temp directories or user profile directories, and tasks with encoded PowerShell commands in the task action.

Registry Run Keys: Check: HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run Also check: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon (Userinit and Shell values should be standard) And: HKLM\SYSTEM\CurrentControlSet\Services (new services with random names or names resembling legitimate services)

Startup Folders: C:\Users[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

WMI Subscriptions (frequently missed by basic audits): Run in PowerShell: Get-WMIObject -Namespace root\subscription -Class __EventFilter Get-WMIObject -Namespace root\subscription -Class __EventConsumer Get-WMIObject -Namespace root\subscription -Class __FilterToConsumerBinding Any results here indicate a WMI subscription that could be used for persistent execution. Legitimate WMI subscriptions are rare in most environments.

DLL Hijacking: Check application directories for DLLs that do not belong there. Attackers place malicious DLLs in directories that are searched before the legitimate DLL path. Use Sigcheck (Sysinternals) to verify DLL signatures: sigcheck -a -h -s [path]

Office Add-ins: Check: HKCU\Software\Microsoft\Office[version][application]\Addins List loaded add-ins in Word and Excel. Malicious Office add-ins are a persistence mechanism that survives most EDR scans because they execute within the legitimate Office process.

Network indicators often reveal compromise that endpoint tools miss because the attacker's tools are designed to look benign on the endpoint but the network behavior remains distinctive.

Active Connections: netstat -ano (Windows) or ss -tulnp (Linux) For each established connection to an external IP, look up the IP in threat intelligence (VirusTotal, AbuseIPDB, Shodan). Focus on connections to IP addresses rather than hostnames (malware that resolves a hardcoded IP bypasses DNS-based detection), connections on unusual ports, and connections with small but regular data transfer (C2 beaconing).

DNS Query History: If your DNS resolver logs queries (most enterprise DNS servers do), search for:

• Newly registered domains (under 30 days old). Use WHOIS or a threat intel API to check registration date.
• Domains with high-entropy names (randomized characters: aGf8k2mN9.com is more suspicious than supportdesk.company.com).
• DGA (domain generation algorithm) patterns: sequences of similarly-structured domain names queried by the same host over time.
• DNS TXT record queries (sometimes used for C2 data exfiltration in DNS tunneling).
• Uncommon top-level domains (.tk, .ga, .ml, .cf are heavily abused by malware C2).

Network Connection Timing: C2 beacons are often the only network artifact of a memory-resident implant. They are identifiable by regularity: a connection to the same external IP every N minutes, often with a small jitter to avoid exact-interval detection. Pull 24-48 hours of connection logs for the host and plot connection timing to any external IPs you cannot identify as legitimate. Regular intervals of 5-60 minutes to an IP that is not associated with a known service are a high-confidence C2 indicator.

Data Volume Anomalies: Look for hosts with significantly higher than baseline outbound data volume, particularly outside business hours. Data exfiltration often occurs at night. Compare the host's outbound bytes for the last 7 days against its rolling 30-day average. A spike of 3-5x average is worth investigating even if the destination looks benign (attackers use legitimate cloud services like Dropbox, Google Drive, and OneDrive for exfiltration).

Memory-resident threats and process injection require investigation techniques that EDR behavioral detection may not catch.

Process Tree Review: Use Process Monitor or Process Explorer (Sysinternals) on a live host. Look for:

• Processes spawned by unusual parents (cmd.exe spawned by Excel, PowerShell spawned by a web browser, msiexec spawning cmd.exe)
• Processes with no visible window running as SYSTEM or with elevated privileges
• Processes with legitimate names (svchost.exe, explorer.exe) running from unusual paths (C:\Users[user]\AppData instead of C:\Windows\System32)
• Multiple instances of a process that should have only one (two svchost.exe processes running from the same parent but with different command line arguments)

Hollow Processes: Process hollowing creates a legitimate process in a suspended state and replaces its memory with malicious code. The process looks legitimate in the process list but is executing attacker code. Indicators:

• Process executable path does not match the loaded executable in memory (check with Process Explorer: right-click process, Properties, Image tab)
• Process has unexpected DLLs loaded (compare with a known-good system)
• Process has memory regions marked as executable that were written by a different process

Memory Injection Indicators: Look for processes with anonymous (non-file-backed) executable memory regions. In Process Explorer: highlight processes with non-file-backed executable regions in red under View > Select Columns > Process Memory > Private Bytes. Use Volatility (the memory forensics framework) on a captured memory image to identify injected code regions.

LSASS Access: Credential dumping almost always involves accessing the LSASS process (lsass.exe). Check Windows Security Event 4656 and 4663 (if object access auditing is enabled) for unexpected processes opening LSASS with read permissions. Sysmon Event ID 10 (ProcessAccess) specifically logs access to LSASS and is a reliable indicator of credential dumping attempts.

Once an attacker has credentials, their activity often looks legitimate at the endpoint level because they are using real accounts. The investigation must focus on behavioral anomalies at the identity layer.

Recent Authentication Events: For the accounts associated with your anomaly signal, pull authentication logs for the past 30 days:

• Logons from IP addresses not previously seen for that account
• Logons at hours inconsistent with the user's normal pattern
• Authentication to systems the user does not normally access
• Pass-the-Hash indicators: Event ID 4624 with LogonType 3 (network logon) and authentication package NTLM, particularly if the account normally uses Kerberos
• Pass-the-Ticket indicators: Event ID 4769 (Kerberos service ticket request) with unusual encryption type (0x17 = RC4, which is weak and sometimes used in Pass-the-Ticket attacks)

Kerberoastable Accounts: If an attacker has compromised any domain account, they can request Kerberos service tickets for any service account with a Service Principal Name (SPN) and crack the ticket offline. Look for Event ID 4769 with ticket encryption type 0x17 (RC4-HMAC) for service accounts. A spike in these events across multiple service accounts from a single source IP indicates Kerberoasting.

Group Membership Changes: Event ID 4732 (member added to security-enabled local group) and 4728/4756 (member added to global/universal security group). Attackers frequently add their compromised account to local administrator groups or to groups with privileged access. Check all group membership changes in the past 30 days for any high-privilege groups.

Service Account Anomalies: Service accounts should have highly predictable behavior: they authenticate from specific hosts, to specific services, at specific times. Any service account authentication from an unexpected host or to an unexpected service is a high-priority investigation item, because attackers frequently abuse service account credentials harvested from an initial foothold to move to other systems.

Even memory-only threats leave some disk artifacts during their operation. Common locations to check:

Temp and AppData Directories: C:\Windows\Temp, C:\Users[user]\AppData\Local\Temp, and C:\Users[user]\AppData\Roaming are frequently used for staging malicious files. Look for:

• Executable files (.exe, .dll, .ps1, .bat, .vbs, .js, .hta)
• Files with extensions that do not match their content (a .jpg that contains a PE executable)
• Recently created files (within the timeframe of your anomaly signal)

Recycle Bin: Attackers sometimes use the Recycle Bin as a staging location. Check $Recycle.Bin in all drives, including mapped network drives.

Alternate Data Streams: Windows NTFS supports alternate data streams (ADS), which can hide content inside a normal file. Malware and attackers use ADS to hide executables or scripts. Use: dir /r on Windows or streams.exe from Sysinternals to list ADS on suspicious files.

Prefetch Files: Windows prefetch records evidence of program execution even after the executable has been deleted. Check C:\Windows\Prefetch for entries matching the timeframe of your anomaly. Prefetch files are named [EXECUTABLE_NAME]-[HASH].pf. The presence of a prefetch file for an executable that no longer exists on the system is a strong indicator of malware that cleaned up after itself.

ShimCache and Amcache: ShimCache (Application Compatibility Cache) and Amcache.hve are Windows registry and file artifacts that record program execution history. They are often more complete than prefetch. Use Eric Zimmerman's AppCompatCacheParser or AmcacheParser tools to parse these artifacts and identify executables that ran on the system.

Manual investigation has limits. Know when to call external support.

Escalate when:

• Your investigation finds evidence of compromise but you cannot identify the initial access vector. An unidentified entry point means the attacker can return after remediation.
• Evidence points to a sophisticated threat actor with custom tooling. Nation-state actors and advanced criminal groups require specialized forensic capabilities beyond what most internal teams maintain.
• You need legally defensible evidence for regulatory reporting, law enforcement, or litigation. Chain-of-custody requirements for forensic evidence are strict, and evidence collected without proper handling may be challenged.
• The scope appears to span multiple systems and you do not have the analyst capacity to investigate all of them simultaneously. Containment timing matters, and undiscovered compromised systems that remain active while you investigate others can undermine your response.
• You found memory-only malware. Memory forensics requires specialized tooling (Volatility, Rekall) and expertise that most IR teams do not maintain.

When you do escalate, provide the forensics firm with your investigation notes, the specific anomaly signals that started your investigation, the systems you have already investigated, and the artifacts you have collected. Good documentation accelerates external forensic engagement significantly.