1.2 | SOC Tier 1 | Pivoting around Rider.exe (Elastic Defend EDR)

Lesson Description

Rider.exe sits in C:\Windows\System32. Why it stood out during triage, how a Tier 1 analyst approaches an unknown executable, the context that matters (location, process behaviour, user activity), and the questions to answer before escalating. Resources: Vanilla Windows Reference (github.com/AndrewRathbun/VanillaWindowsReference)

Enroll in Chasing Rider to unlock the full curriculum.