Deploy a Host>Based Intrusion Detection Solution
Description
Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.
Implementation Checklist
Tool Recommendations
AI-driven network detection and response with self-learning threat analysis and autonomous response
Darktrace · Enterprise subscription
AI-driven threat detection and response for network, cloud, and identity with attack signal intelligence
Vectra AI · Enterprise subscription
Network detection and response platform with real-time traffic analysis, encrypted traffic inspection, and cloud visibility
ExtraHop · Per-device/bandwidth subscription
Network traffic analysis platform using behavioral modeling and machine learning to detect threats and anomalies
Cisco · Per-flow subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Fileless Malware Execution on Unmonitored Endpoints
ConfidentialityAn attacker deploys fileless malware using PowerShell or WMI that operates entirely in memory, evading network-level detection because no host-based intrusion detection solution is monitoring process behavior.
Insider Threat Data Harvesting on Endpoints
ConfidentialityA malicious insider installs credential harvesting tools or keyloggers on their workstation, which go undetected without host-based intrusion detection monitoring local system activity.
Rootkit Persistence Without Host-Level Detection
IntegrityAn attacker installs a kernel-level rootkit that persists across reboots and hides malicious processes from standard OS tools, remaining invisible without a dedicated HIDS examining system integrity.
Vulnerabilities (When Safeguard Absent)
No Visibility into Host-Level Attack Indicators
Without host-based intrusion detection, suspicious process executions, file integrity changes, and registry modifications on individual endpoints go unmonitored, allowing attackers to operate freely post-compromise.
Inability to Detect Memory-Resident Threats
Absent HIDS capabilities, attacks that never touch disk such as in-memory exploits, living-off-the-land techniques, and process injection cannot be identified at the endpoint level.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |