How EDR Works

Try it out loud first. Then check yourself:

1. Kernel callbacks, ETW (including ETW-TI) and minifilters give process, file, registry and network telemetry.
2. Detections combine signatures, behavior rules and ML; data is streamed to a cloud backend for hunting.
3. Response actions: network isolate host, kill process, quarantine file, and collect forensic packages remotely.
4. Attackers target EDR via user-mode hook unhooking, direct syscalls and BYOVD to kill agents.

If the interviewer pushes back

• Why are kernel callbacks harder to evade than user-mode API hooks, and how does BYOVD defeat them?

Go deeper

• attack.mitre.org/techniques/T1562/001/