Academy
TermDefence

Endpoint detection and response

(EDR)

Security software that records process, file and network events on computers and servers, detects suspicious behaviour and enables response.

Flow

  1. 1Recording
  2. 2Detection
  3. 3Response
Related families
Lumma Stealer
MITRE ATT&CK
T1555.003 · Credentials from Web Browsers
Sources
4 sources
01

Overview

NIST describes endpoint detection and response as a security approach that monitors, detects and responds to threats on endpoints. NIST CSRC

The difference from signature-based antivirus is that it looks at behaviour: an unknown process reading the browser’s password database stands out even if its file has never been seen before. MITRE ATT&CK

02

How it works

  1. 1

    Recording

    Process starts, file access and network connections are recorded. NIST CSRC

  2. 2

    Detection

    Rules and behaviour models evaluate the events. NIST CSRC

  3. 3

    Response

    The process is stopped and the device is isolated from the network. NIST CSRC

03

Real-world examples

Behaviours in the Lumma advisory

Lumma Stealer profile

The CISA and FBI Lumma advisory listed behaviours suitable for detection rules with ATT&CK techniques; PowerShell started from the Run dialog is one of them. CISA and FBI (AA25-141B)

04

How to detect it

  • A process other than the browser accessing password and cookie files in the browser profile folder. MITRE ATT&CK
05

What to do

  • Check that the software runs in blocking mode and is installed on every device. MITRE ATT&CK
06

MITRE ATT&CK

T1555.003Credentials from Web Browsers
07

Related families and terms

Families

Lumma StealerActive

Report

Infostealer Threat Report — October 2026

Terms

Extended detection and responseLiving off the landQuarantine
08

Sources

  1. 1Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  2. 2Endpoint detection and response — glossary definition · NIST CSRC
  3. 3Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  4. 4Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans