Process Management

Patching, live process monitoring, and detecting attacks on a device  ·  Approx. 2 class days

StarringSignature-Based vs. Behavior-Based Detection

Use this as a quick reference for the patch cycle, detection method comparison, IoC types, and detection method criteria.

Process Monitoring and Detecting Attacks on a Device infographic

🧭 Plot Summary

Everything you've done so far has been about static defenses — locking things down before anything happens. This activity is where you start watching a live system. You'll open up process monitoring tools on the PLTW virtual server and actually look at what's running right now — which is exactly where a lot of real intrusions get caught.

You'll also compare the two fundamentally different ways detection tools work:

Signature-Based
Matches known malware patterns — fast, low resource use, but blind to brand-new attacks
Behavior-Based
Flags deviations from a normal baseline — catches novel attacks, but uses more resources

What you will do in this lesson

  • Explore process monitoring tools on the PLTW virtual server to see what's actually running.
  • Learn why patches matter and what happens to a device that falls behind on updates.
  • Compare signature-based detection to behavior-based detection.
  • Practice spotting indicators of compromise across three categories: host, file, and behavior.
  • Weigh the real tradeoffs — performance cost, licensing cost, and device sensitivity — in choosing a detection method.

Why it matters

Patching and passive defenses only get you so far. Sooner or later, something slips through — and this is where you learn to actually notice when it does.

✅ Self-Check Before You Roll On

Check off each item as you get there. These are not grades — they are your own signal.