← All Lessons
Premium
TechniqueActive Directory
EDR Evasion Fundamentals
An EDR is a telemetry system, not a wall, and its most common sensor is a monitoring DLL that runs inside the very process it is watching, in memory that process is allowed to rewrite. This lesson explains where an EDR actually observes from, why the sensors that share your address space can be avoided, removed, or blinded, and how to communicate the risk clearly in interviews, reports, and stakeholder conversations.
Sign in or upgrade to unlock the full premium library.
What you'll learn
- EDR (Endpoint Detection and Response)
- User-mode function hooking
- Manual (direct) syscalls
- Unhooking
- Kernel callbacks
- ETW / AMSI blinding
What premium includes
- All 78 lessons: AD techniques, professional skills, each with interview answers and study kits
- Complete study kit for every lesson: quizzes, flashcards, and briefs
- Every learning track with full structured progression
- All 12 attack paths: full compromise walkthroughs for interviews and reports
- New lessons and attack paths added regularly
