EDR / XDR

The EDR (Endpoint Detection and Response) is the blue team’s sensor and executor on the endpoint: it observes process behavior, detects techniques, and enables response (isolate, kill, collect). XDR extends that visibility and response to network, identity, email, and cloud in a correlated way.

What an EDR does

Telemetry     processes, threads, DLL loads, network, registry, files, API/syscalls
Detection     by behavior (not just signature): injection, LSASS access, LOLBins...
Response      isolate host, terminate process, quarantine, collect artifacts
Hunting       real-time/historical query across the fleet (basis for def-hunting)
Rollback      some revert ransomware changes

EDR vs antivirus vs XDR

Classic AV   file signatures -> evadable with unique payloads (see mal-evasion)
EDR          behavior + telemetry + response on the endpoint
XDR          correlation of endpoint + network + identity + email + cloud in one console
MDR          EDR/XDR operated as a service by a provider (external SOC)

How it detects (and what the attacker evades)

Detects: CreateRemoteThread, injection/hollowing, RWX memory, region patching,
         access to lsass.exe, anomalous command lines, odd children of office/browser
The attacker tries: AMSI/ETW patching, unhooking, direct syscalls, BYOVD (see mal-evasion)
-> that's why ANTI-TAMPER and kernel telemetry (ETW-TI) resisting user-land matter

Deployment and operation

- coverage: an agent on EVERY endpoint/server (gaps are the attacker's path)
- mode: start in detection and move to prevention/blocking with tuning
- anti-tamper enabled; protect agent uninstall with a password/policy
- integration with SIEM/SOAR (def-siem) and with the IR process (dfir)

Blue Team / validation

• Validate with emulation (Atomic Red Team, see Threat hunting): does the EDR see and block each TTP?
• Tune exclusions carefully: a broad exclusion is a hole the attacker will look for.
• Watch for down/missing agents and versions; measure real fleet coverage.
• Don’t rely on EDR alone: combine with hardening (System hardening), network (Network hardening), and identity (Identity management (IAM)).

Real-world cases

• BYOVD (signed vulnerable drivers, e.g. CVE-2021-21551) used by ransomware to kill the EDR from kernel.
• EDR evasion/unhooking techniques documented in red teams and real malware (see Defense Evasion).
• Incidents where agent-less endpoints (shadow IT, forgotten servers) were the entry point.

Testing checklist

• Agent coverage on every endpoint/server (no gaps)
• Prevention mode with tuning; anti-tamper enabled
• Validate detection of injection/LSASS/LOLBins with Atomic Red Team
• Detection of evasion attempts (AMSI/ETW/unhooking/BYOVD)
• Integration with SIEM/SOAR and IR
• Review exclusions and down agents
• Driver Blocklist / HVCI against BYOVD

References

• MITRE ATT&CK — TA0005
• Atomic Red Team — tests per ATT&CK technique
• microsoft.com — Microsoft defender for endpoint
• detection-rules — elastic (GitHub)