877-864-4204

Bypassing ETW For Fun and Profit

EDR products have the option of using multiple sources to collect information on a Widows operating system. One of these log sources is ETW (Event Tracing for Windows). ETW consumers are now integrated into many EDR endpoint agents in order to receive CLR Runtime...

Neutering the EDR

EDR (Endpoint Detection and Response) products attempt to detect misbehavior that slightly  deviates from the baseline, by continuously analyzing the memory for inter-process interactions. While a few so-called EDRs are still strongly based on signatures for...