---
title: "Discussion on \"What EDR Reveals After a Suspicious Document Opens\" | Hashnode"
description: "Discussion on \"What EDR Reveals After a Suspicious Document Opens\". Follow the evidence from the first alert to the downloaded file, and learn how EDR helps determine what ran, what stopped, and what remains uncertain."
url: "https://hashnode.com/posts/what-edr-reveals-after-a-suspicious-document-opens/6aba964e5f1a504879cedaf6"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [What EDR Reveals After a Suspicious Document Opens](https://tirthaklikhar.hashnode.dev/what-edr-reveals-after-a-suspicious-document-opens?utm_source=hashnode&utm_medium=feed)

Follow the evidence from the first alert to the downloaded file, and learn how EDR helps determine what ran, what stopped, and what remains uncertain.

Sep 28 · 6 min read · tirthaklikhar.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#soc-analyst](https://hashnode.com/tag/soc-analyst)
-   [#threatdetection](https://hashnode.com/tag/threatdetection)
-   [#endpoint-security](https://hashnode.com/tag/endpoint-security)
-   [#edr](https://hashnode.com/tag/edr)
-   [#blueteam](https://hashnode.com/tag/blueteam)
-   [#threat-hunting](https://hashnode.com/tag/threat-hunting)
-   [#incident-response](https://hashnode.com/tag/incident-response)

## Written by

[Tirthak Likhar](https://hashnode.com/@tirthak10)

@tirthak10 · Pune, India

  
[View profile](https://hashnode.com/@tirthak10)

I build SOC labs, break things deliberately, and write about what I find.

CSE student and aspiring SOC analyst. I write about building security labs, threat detection, and the honest experience of learning blue team cybersecurity from the ground up.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.