Use Case

Know What's Running

Execution Visibility That Drives Prevention

82% of high-severity breaches involve Living off the Land techniques — attacks that use legitimate, signed tools already present on the endpoint. EDR alone struggles to distinguish trusted administrative activity from malicious use of the same binaries. MagicSword closes that gap with deep endpoint telemetry and threat-driven execution control across Windows, macOS, and Linux.

Cross-Platform Endpoint Telemetry

Lightweight agents collect process execution data, software inventory, and browser extension details continuously across your fleet. Every execution event includes the context security teams need to assess risk and build policy.

→Process execution with parent-child process chains and command line capture
→Software inventory including Win32 applications and Microsoft Store apps
→Browser extension inventory across Chrome, Edge, and Firefox
→Windows event log collection including code integrity and enforcement events
→File hash, publisher, and certificate verification per execution

Telemetry updates continuously via agent heartbeat.

Data collected per process:

→Execution count and unique user count
→Endpoints where the process has run
→First seen and last seen timestamps
→Command line samples with abuse pattern flagging
→Parent process chain reconstruction

Closing the EDR Trust Gap

EDR excels at detection and response but faces a fundamental challenge: verifying the intent of trusted, signed tools. Over 200 legitimate Windows binaries are commonly abused by attackers, 505+ known vulnerable drivers can bypass security controls entirely, and 284 documented RMM tools are routinely weaponized. MagicSword adds the prevention layer EDR cannot — cross-referencing every execution against continuously updated threat intelligence to block documented abuse patterns before damage occurs.

Autonomous threat investigation:

→Timeline analysis with execution context around suspicious activity
→Cross-endpoint correlation and fleet-wide spread analysis
→Command line abuse pattern detection — encoded commands, download cradles, policy bypass attempts
→MITRE ATT&CK technique mapping for every finding

Per Role. Per Endpoint. Without Guesswork.

MagicSword allows organizations to control what can run based on group, role, and endpoint. Security teams get a clear view of execution patterns and the tools to act on them.

→See what is allowed, blocked, and audited per endpoint
→Identify risky execution pathways through parent-child process chains
→Enforce policies aligned to real usage patterns across the fleet
→Track software inventory and version distribution across all endpoints
→Reduce unnecessary exposure with measurable endpoint attack surface reduction

The Trust Gap

EDR detects and responds. Application control prevents and enforces. Together they create defense in depth — stopping attacks at multiple independent chokepoints before they escalate.