Stay informed on the latest in Endpoint Detection & Response (EDR): Expert insights, attack prevention, and advanced threat management solutions.
Search across headline titles and summaries.
Background for this topic.
Endpoint Detection and Response (EDR) is software that records endpoint activity—such as process launches, file changes, scripts, logins, and network connections—to detect suspicious behavior and support investigation. It can alert analysts, trace an intrusion across affected devices, and take actions such as isolating an endpoint or terminating a process. Its purpose is to reduce attacker dwell time and limit movement after an endpoint is compromised.
EDR is most useful against techniques that evade simple antivirus signatures, but it is not a guarantee of visibility: attackers may exploit unmonitored devices, disable or tamper with an agent, or blend into legitimate administration. Effective deployment requires broad, maintained coverage; protected agents and access controls; sensible alert tuning; and retention of telemetry for threat hunting and scoping incidents. Organizations should regularly test isolation and response actions, address agent and endpoint vulnerabilities, and account for the privacy and access implications of collecting detailed user and device activity.
Weekly headline count for the current query.
The attack vector is available for rent at scale, and evades AV and EDR, leaving YARA analysis as the best detection option.
Python scripts were used to test malware against endpoint detection and response agents from Sophos, CrowdStrike, and Windows Defender.
Stopping EDR killers, which employ bring-your-own-vulnerable-driver (BYOVD) attack techniques, is difficult, but not impossible.
A campaign by Russian-speaking cyberattackers hijacks workflows to deliver security-busting malware, allowing attackers to steal data without detection.
The forensic tool's driver was signed with a digital certificate that expired years ago, but major security gaps allowed Windows to load it.
The initial access broker has been weaponizing endpoint detection and response (EDR) platforms and Windows utilities in recent high-precision attacks.
Shanya is the latest in an emerging field of packing malware, selling obfuscation functionality in order to help ransomware actors reach their target.
The China-linked cyber-espionage group UNC5221 is compromising network appliances that cannot run traditional EDR agents to deploy new versions of the "Brickstorm" backdoor.
By weaponizing the ThrottleStop.sys driver, attackers are disrupting antivirus and endpoint detection and response (EDR) systems.
A threat actor is using a sophisticated EDR-killing malware tool in a campaign to maintain long-term, persistent access on Windows systems.
While several cybercrime groups have embraced "EDR killers," researchers say the deep knowledge and technical skills demonstrated by Crypto24 signify a dangerous escalation.
An upgraded cybercrime tool is designed to make targeted ransomware attacks as easy and effective as possible, with features like EDR-spotting and DNS-based C2 communication.
Researchers have uncovered multiple campaigns spreading Lumma, Arechclient2, and Rhadamanthys malware by leveraging key features of the AV/EDR evasion framework.
Researchers from Aon's Stroz Friedberg incident response firm discovered a new attack type, known as "Bring Your Own Installer," targeting misconfigured SentinelOne EDR installs.
The notorious nation-state-backed threat actor has added two new keyloggers, a lateral movement tool, and an endpoint detection and response (EDR) evasion driver to its arsenal.
Blind spots in network visibility, including in firewalls, IoT devices, and the cloud, are being exploited by Chinese state-backed threat actors with increasing success, according to new threat intelligence. Here's how experts say you can get eyes on it all.
A successful enterprise security defense requires a successful endpoint security effort. With options ranging from EDR, SIEM, SOAR, and more, how do security teams cut through the clutter and focus on what matters?
Next-level malware represents a new era of malicious code developed specifically to get around modern security software like digital forensics tools and EDR, new research warns.
Arctic Wolf plans to integrate Cylance's EDR technology into its XDR platform.
The consolidation folds Cybereason’s endpoint detection and response (EDR) platform into Trustwave’s managed security services offerings.