Testing Endpoint and Application Controls

A subject performs a limited action on an organizational endpoint to determine whether software restrictions, endpoint security controls, browser management, device controls, or application policies prevent or report the behavior.

The subject may install a low-impact unauthorized application, add a browser extension, execute a portable utility, alter a minor endpoint setting, or attempt to run software from an unusual location. They may also connect a removable device or use a test script to establish whether application allowlisting, Endpoint Detection and Response (EDR), antivirus, mobile device management, or device-control policies are active.

The test may be designed to resemble ordinary experimentation or troubleshooting. Investigators should consider whether the subject subsequently used the same installation method, application type, device, or control weakness to support data collection, persistence, circumvention, or another infringement.