Flying Under the EDR Radar

This webinar explores how advanced attackers bypass endpoint detection and response (EDR) solutions by operating below traditional detection layers. It explains how EDR tools rely on user-mode hooks and system call monitoring, and how attackers use direct syscall invocation to evade those mechanisms. The session dives into Windows internals and demonstrates how bypass techniques avoid common behavioral detection triggers.

A live demonstration contrasts traditional API-based injection, which triggers detection, with syscall-based injection that executes without alerting EDR. The webinar concludes with defensive recommendations, including monitoring abnormal call stack behavior and validating detection assumptions through realistic testing. The core message emphasizes continuously testing defenses against real-world evasion techniques.