NASA·Software Engineer·Technical Phone Screen·Intermediate

Intermediate

May 2026

Summary

Security analyst interview at NASA with a scenario-based question about investigating a specific alert type in Sentinel. Pretty focused, just the one question from what I remember, but it required you to actually think through an investigation workflow on the spot.

Questions Asked (1)

You're looking at an alert in Sentinel labeled 'EDR killer'. What does that mean to you, and how would you go about investigating it?

Root Cause AnalysisSystem DesignTechnical Trade-offs

Author's notes

I knew what EDR killers were conceptually but stumbled a bit connecting it to a concrete investigation flow in Sentinel specifically.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by defining what an 'EDR killer' alert means—a tool or technique designed to disable endpoint detection and response (EDR) agents, often a precursor to ransomware or other malicious activity. Then outline a structured investigation: validate the alert, scope the impact, analyze the kill chain, and recommend remediation. Emphasize a methodical, evidence-based approach that balances urgency with thoroughness.

Pro tip: Demonstrate familiarity with MITRE ATT&CK technique T1562.001 (Impair Defenses: Disable or Modify Tools) and mention that you'd check for lateral movement or data exfiltration attempts, as EDR killers are often used in the later stages of an attack. Also, highlight the importance of preserving forensic evidence before remediation.

1. Validate and Triage

Confirm the alert is a true positive by reviewing the raw telemetry, process tree, and command-line arguments. Check if the EDR agent is actually disabled or if it's a false alarm due to a legitimate administrative action.

2. Scope and Contain

Identify all affected endpoints and user accounts. Determine if the activity is isolated or part of a broader campaign. Isolate compromised machines from the network to prevent lateral movement, but preserve memory and disk artifacts for forensics.

3. Analyze the Attack Chain

Investigate how the EDR killer was delivered (e.g., phishing, exploit, lateral movement) and what other malicious activities occurred. Look for persistence mechanisms, privilege escalation, and data exfiltration attempts.

4. Remediate and Recover

Remove the malicious tool, restore EDR functionality, and patch vulnerabilities. Reset compromised credentials and reimage systems if necessary. Verify that the threat is fully eradicated before reconnecting to the network.

5. Document and Improve

Record findings, update detection rules, and share lessons learned with the security team. Consider enhancing EDR tamper protection and implementing additional monitoring for similar techniques.

Key Points to Mention

Definition of EDR killer: tools like Backstab, EDRSilencer, or custom scripts that terminate or uninstall EDR processes.
MITRE ATT&CK mapping: T1562.001 (Impair Defenses) and potential follow-on techniques like T1486 (Data Encrypted for Impact).
Importance of preserving volatile evidence (memory, network connections) before remediation.
Use of Sentinel's built-in features: KQL queries, incident graph, and automation rules for rapid response.
Coordination with endpoint team and threat intelligence to identify indicators of compromise (IOCs).
Post-incident actions: root cause analysis, gap assessment, and hardening EDR configurations.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.