EDR

EDR agents hook the OS (kernel callbacks and ETW on Windows, eBPF or the audit framework on Linux, Endpoint Security on macOS) to stream telemetry: process creation with command line and parent, file writes, network connections, module loads. The backend runs behavioural detections and lets responders isolate a host, kill processes, collect files and run scripts.

Unlike classic antivirus, which matches files, EDR watches behaviour, so it catches credential dumping, LOLBin abuse and ransomware encryption patterns even without a known hash.

Attackers target it directly: disabling or unhooking the agent, bring-your-own-vulnerable-driver attacks to kill it from the kernel, or operating from unmanaged hosts. Coverage gaps (servers without agents, agents in passive mode) are a common incident finding. Tamper protection and alerting on agent health matter as much as detections.