Thesis · UPDS · 2024 Threat Intelligence EDR NIST CSF 2.0
Cyber Threat Analysis Using EDR Technology to Strengthen Information Security in Cochabamba SMEs
Paola C. Medrano Pizarrozo · Universidad Privada Domingo Savio · Network & Telecommunications Engineering · July 2024
This work presents the first documented endpoint detection and response (EDR) deployment study in Bolivian small and medium-sized enterprises, producing primary threat intelligence data from a population with no prior empirical coverage in the published literature.
Across two operational companies in Cochabamba over two months, the deployment detected 234 malware instances, two APT-level behavioral indicators, and 632 suspicious PowerShell events. The analysis identifies illegal software activators as the dominant infection vector, a finding that challenges the common assumption that phishing or external exploitation are the primary attack surfaces in SME environments.
Contributions
C1 Original threat telemetry from Bolivian SMEs
A two-month real-world EDR deployment across 16 endpoints in two operational companies, producing the first primary threat intelligence dataset from this LATAM context. No prior published study had documented this environment empirically.
C2 First NIST CSF 2.0 evaluation at micro-SME scale in Bolivia
A structured evaluation of all 106 NIST CSF 2.0 subcategories using EDR telemetry, direct observation, port scanning, and structured interviews. This establishes a reproducible baseline measurement methodology applicable to organizations with no prior security posture.
C3 Empirical evidence of the piracy-to-malware infection chain
Illegal software activators (KMSpico-type) used to bypass licensing for Windows, AutoCAD, and Office are identified as the dominant malware entry point, accounting for the majority of trojan and cryptomining detections. This positions piracy as a structural security risk, not an individual behavior.
C4 A security improvement algorithm for zero-baseline organizations
A step-by-step security maturity path for SMEs with no existing governance structure, grounded in the NIST CSF 2.0 evaluation results and aligned with ISO/IEC 27001 and GDPR requirements.
Motivation
Bolivia ranks 140th out of 194 countries in the Global Cybersecurity Index, the worst score in South America, while SMEs account for 44% of national GDP and 70% of private employment. The combination of high economic relevance, low security maturity, and near-total absence of empirical threat data makes this a meaningful gap for the security research community.
Most available security guidance assumes infrastructure, budget, and institutional knowledge that simply does not exist in this population. International frameworks such as NIST CSF and ISO 27001 provide useful structure, but applying them requires adapting their evaluation methodology to organizations that have no baseline from which to measure progress.
Cyber risk exposure in Bolivia (%)
Study design
Sangfor Endpoint Secure was deployed on all accessible endpoints across two operational companies in Cochabamba's Cercado province. Because both companies ran mixed OS environments on aging hardware, three deployment methods were required: USB installation, offline installer, and email link. A one-week observation window with no restrictions preceded full protection activation, establishing a behavioral baseline before containment.
The NIST CSF 2.0 evaluation covered all 106 subcategories across six functions (Govern, Identify, Protect, Detect, Respond, Recover), combining EDR telemetry with direct observation, port scanning, and structured CEO interviews. Scoring relied on qualitative evidence and is subject to the subjectivity that accompanies interview-based assessment.
Company A: Geotechnical Engineering
12 endpoints Windows 7 to 11, most unpatched. Professional software (AutoCAD, ArcGIS, Civil 3D) largely unlicensed, activated with KMSpico-type tools. Had received a lawsuit for delivering client services using pirated AutoCAD at the time of the study.
Company B: Telecommunications
4 endpoints Windows 7 to 11, all unpatched. Windows Security as sole protection layer. Had replaced the primary server six months prior, concluding the hardware was physically failing. EDR deployment revealed the actual cause was cryptomining malware running undetected since an unknown date.
Findings
The two-month monitoring window produced 234 malware detections, two APT-level behavioral indicators, and 632 suspicious PowerShell alerts across 16 endpoints. Trojans represent 60.94% of all detections, almost entirely traceable to illegal software activators bundled with unlicensed copies of Windows, AutoCAD, and Office. This finding reframes the threat model for this environment: the dominant attack surface is not email phishing or external exploitation, but the software supply chain for pirated tools.
Malware distribution: 234 detections across both companies
- Trojan 142 60.94%
- PUP Software 36 15.45%
- Adware/hacktools 23 9.87%
- Cryptomining 16 6.87%
- Activator 15 6.44%
- Backdoor 2 0.86%
APT-level behavioral indicators, Company A · SOC investigation
ALERT · HIGH DESKTOP-3VHFVU9 · June 2024 Gene Analysis Engine
Trigger
! chrome.exe → outbound C2 traffic on port 443 at regular intervals with no active user session
Investigation
→ Process tree: explorer.exe › chrome.exe (legitimate parent)
→ Network: connections to unknown ASN, beacon interval ~60 s
→ No browser window open, no user input during events
→ Windows Security and Panda: no alert
MITRE ATT&CK
T1071.001 · Web Protocols
ALERT · MEDIUM Endpoint: Gosler · June 2024 · 12 events Behavioral Engine
Trigger
! java.exe creating unsigned executables in AppData\Temp, 12 events across 3 days
Investigation
→ Parent process: Minecraft launcher (java.exe)
→ Child processes: randomized .exe filenames, non-standard paths
→ File creation events consistent with tool staging, not game activity
→ No detection from legacy AV on same endpoint
MITRE ATT&CK
T1105 · Ingress Tool Transfer
Tactic
Initial Access / Execution
Both indicators were detected exclusively by the Sangfor behavioral and Gene Analysis engines. Windows Security and Panda Antivirus, active on the same endpoints, produced no alert for either event.
Case: undetected cryptomining, Company B
Company B observed severe and progressive server performance degradation over several months. With no security monitoring in place, the IT team concluded the hardware was physically failing and replaced the entire unit. The cryptominer was not identified, migrated silently to the new machine, and continued operating. EDR deployment revealed the actual cause: the server had been actively mining cryptocurrency for an external attacker for an unknown period, consuming CPU resources and electricity without triggering any alert from the existing protection layer.
Security posture
Both companies scored 1.5 out of 4 on the NIST CSF 2.0 evaluation, placing them at the second-lowest maturity tier. This score indicates that cybersecurity risk management is not yet integrated into organizational practice. Neither company had a written security policy, an incident response plan, or a designated security committee. Critical gaps concentrated in identity management, governance oversight, and security awareness, all areas where technology deployment alone provides no improvement.
NIST CSF 2.0 score: current state and improvement targets
Security improvement algorithm
A step-by-step security maturity path for SMEs with no existing governance structure, derived from the NIST CSF 2.0 evaluation results and aligned with ISO/IEC 27001. The target is reaching a score of 4.0/4 within 12 months.
01 NIST CSF 2.0 Assessment
Evaluate all 106 subcategories across Govern, Identify, Protect, Detect, Respond, Recover. Score below 2.0 triggers immediate containment: isolate compromised endpoints before proceeding.
Install agents on all accessible endpoints. Run one week in observation mode without restrictions to establish a behavioral baseline before activating protection modules.
03 Activate protection modules
Enable antimalware engines, real-time protection, anti-ransomware honeypot, brute-force detection, WebShell detection, and hot patching simultaneously.
04 Establish security policies
- · Password management ISO 27001 A.9.4.3
- · Software download control: block piracy tools NIST PR.IR-1
- · Replace pirated software or use open-source ISO 27001 A.12.1.2
- · Create a cybersecurity committee ISO 27001 Clause 5.1
- · Strong passwords and credential hygiene
- · Recognize phishing and social engineering
- · Handle sensitive data and devices safely
- · Report incidents: know who to contact
06 Continuous monitoring and re-evaluation
EDR 24/7 monitoring, NIST CSF re-evaluation every 6 months, incident response drills. Loop back to Step 1 until reaching 4.0/4.
Open questions
This study is limited in sample size, monitoring duration, and geographic scope. It is intended as a first empirical foothold, not a generalizable conclusion. The following questions emerge directly from the data and the gaps it exposes.
Regional threat measurement
Is the piracy-to-malware vector a Bolivia-specific pattern, or a LATAM-wide phenomenon?
A longitudinal study across multiple countries and sectors is needed to determine whether illegal activators as a primary infection vector reflect Bolivia's licensing enforcement context or a broader regional dynamic.
Usable security
What is the minimum viable EDR configuration for an organization with no dedicated IT staff?
This study applied enterprise-grade configuration to micro-SMEs. Future work should characterize the tradeoff between detection coverage and operational complexity for organizations that cannot sustain a monitoring burden.
Automated security assessment
Can behavioral EDR telemetry be used to partially automate NIST CSF 2.0 scoring?
Evaluating 106 subcategories manually requires significant time and introduces interviewer subjectivity. EDR telemetry overlaps substantially with the Detect and Respond functions; automated mapping could make continuous baseline measurement viable at scale.
Dwell time estimation
How long do cryptominers persist undetected in unmonitored SMEs?
The Company B case demonstrates that cryptomining can remain active long enough for an organization to replace hardware without identifying the cause. The actual dwell time distribution in this population is unknown and likely underestimated.
Conclusions
01EDR integration succeeded across both companies despite legacy infrastructure constraints, detecting cryptomining and APT-level behavioral activity that had been invisible to the existing antivirus layer.
02Trojans represent 60.94% of detections, with illegal software activators as the primary infection vector. This positions software piracy as a structural security risk in resource-constrained SME environments, not an individual behavioral failure.
03Two MITRE ATT&CK indicators (T1071, T1105) found in Company A are consistent with an active initial access phase. Without behavioral EDR, these events would have remained undetected indefinitely.
04Both companies score 1.5/4 on NIST CSF 2.0. The data supports a conclusion that is likely to generalize: endpoint technology deployment addresses detection gaps but does not substitute for governance, identity management, or organizational security awareness.