Endpoint Threat Protection Essentials

The **Endpoint Threat Protection Essentials** solution provides content to monitor, detect and investigate threats related to windows machines. The solution looks for things like suspicious commandlines, PowerShell based attacks, LOLBins, registry manipulation, scheduled tasks etc. which are some of the most commonly used techniques by attackers when targeting endpoints. **Pre-requisites:** This is a [domain solution](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution supports the connectors listed below. Install one or more of the listed solutions, to unlock the value provided by this solution. 1. Windows Security Events 2. Microsoft Defender XDR 3. Windows Forwarded Events **Keywords:** LOLBins, PowerShell, Registry, Lsass, Commandline, scheduled tasks, Malware.