CINXE.COM

<!DOCTYPE html> <html lang="en" dir="ltr" xmlns:og="https://ogp.me/ns#"> <head> <link rel="profile" href="https://www.w3.org/1999/xhtml/vocab" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut icon" href="https://nostarch.com/sites/default/files/favicon.ico" type="image/vnd.microsoft.icon" /> <meta name="description" content="A guide to understanding the attack-detection software running on Microsoft systems, and how to evade it." /> <meta name="generator" content="Drupal 7 (http://drupal.org)" /> <link rel="image_src" href="https://nostarch.com/sites/default/files/EvadingEDR_cover.png" /> <link rel="canonical" href="https://nostarch.com/evading-edr" /> <link rel="shortlink" href="https://nostarch.com/node/741" /> <meta property="og:type" content="article" /> <meta property="og:url" content="https://nostarch.com/evading-edr" /> <meta property="og:title" content="Evading EDR" /> <meta property="og:description" content="A guide to understanding the attack-detection software running on Microsoft systems, and how to evade it." /> <meta property="og:updated_time" content="2024-05-23T06:54:14-07:00" /> <meta property="og:image:url" content="https://nostarch.com/sites/default/files/EvadingEDR_cover.png" /> <meta property="og:image:secure_url" content="https://nostarch.com/sites/default/files/EvadingEDR_cover.png" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:site" content="@nostarch" /> <meta name="twitter:url" content="https://nostarch.com/evading-edr" /> <meta name="twitter:title" content="Evading EDR" /> <meta name="twitter:description" content="A guide to understanding the attack-detection software running on Microsoft systems, and how to evade it." /> <meta name="twitter:image" content="https://nostarch.com/sites/default/files/EvadingEDR_cover.png" /> <meta property="product:price:amount" content="59.99" /> <meta property="product:price:currency" content="USD" /> <meta property="product:isbn" content="9781718503342" /> <meta property="article:published_time" content="2023-03-06T07:41:41-08:00" /> <meta property="article:modified_time" content="2024-05-23T06:54:14-07:00" /> <meta property="product:retailer_part_no" content="bookofedr-combo" /> <meta property="product:mfr_part_no" content="bookofedr-combo" /> <title>Evading EDR | No Starch Press</title> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_lQaZfjVpwP_oGNqdtWCSpJT1EMqXdMiU84ekLLxQnc4.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_guSWpwqRBCVb2J7ivC8BaNuaPffCXmbkGB5xDBqKKu8.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_Dw0rmhFX_owMmlf1HH5Y-_BnOHcMlkri1yMjYHD4ffs.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_XJm3Wqia1GUjoI4j54duSLNZVR3Kxhbwy0s3UwuhhHg.css" media="all" />   <script src="//ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script>window.jQuery || document.write("<script src='/sites/all/modules/contrib/jquery_update/replace/jquery/2.2/jquery.min.js'>\x3C/script>")</script> <script src="https://nostarch.com/misc/jquery-extend-3.4.0.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery-html-prefilter-3.5.0-backport.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery.once.js?v=1.2"></script> <script src="https://nostarch.com/misc/drupal.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/jquery_update/js/jquery_browser.js?v=0.0.1"></script> <script src="https://nostarch.com/misc/form-single-submit.js?v=7.103"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_file/uc_file.js?steosx"></script> <script src="https://nostarch.com/sites/all/libraries/colorbox/jquery.colorbox-min.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/styles/plain/colorbox_style.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_load.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_inline.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_cart/uc_cart_block.js?steosx"></script> <script src="https://nostarch.com/sites/all/modules/contrib/google_analytics/googleanalytics.js?steosx"></script> <script src="https://www.googletagmanager.com/gtag/js?id=UA-5027625-1"></script> <script>window.google_analytics_uacct = "UA-5027625-1";window.dataLayer = window.dataLayer || [];function gtag(){dataLayer.push(arguments)};gtag("js", new Date());gtag("set", "developer_id.dMDhkMT", true);gtag("config", "UA-5027625-1", {"groups":"default","anonymize_ip":true});gtag("config", "G-51XGZT9Y4H", {"groups":"default","anonymize_ip":true});</script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/bootstrap.min.js?steosx"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/main.js?steosx"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/front_grid_height.js?steosx"></script> <script>jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","setHasJsCookie":0,"ajaxPageState":{"theme":"nostarch","theme_token":"oGeXc-9Lu4bHq8LEbCO1p9AiJ_ZyiKOl4kBtvx5gjwA","js":{"sites\/all\/modules\/contrib\/addthis\/addthis.js":1,"sites\/all\/libraries\/shariff\/shariff.min.js":1,"sites\/all\/themes\/contrib\/bootstrap\/js\/bootstrap.js":1,"\/\/ajax.googleapis.com\/ajax\/libs\/jquery\/2.2.4\/jquery.min.js":1,"0":1,"misc\/jquery-extend-3.4.0.js":1,"misc\/jquery-html-prefilter-3.5.0-backport.js":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"sites\/all\/modules\/contrib\/jquery_update\/js\/jquery_browser.js":1,"misc\/form-single-submit.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.js":1,"sites\/all\/libraries\/colorbox\/jquery.colorbox-min.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox.js":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_load.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_inline.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.js":1,"sites\/all\/modules\/contrib\/google_analytics\/googleanalytics.js":1,"https:\/\/www.googletagmanager.com\/gtag\/js?id=UA-5027625-1":1,"1":1,"sites\/all\/themes\/nostarch\/js\/bootstrap.min.js":1,"sites\/all\/themes\/nostarch\/js\/main.js":1,"sites\/all\/themes\/nostarch\/js\/front_grid_height.js":1},"css":{"modules\/system\/system.base.css":1,"modules\/field\/theme\/field.css":1,"sites\/all\/modules\/contrib\/logintoboggan\/logintoboggan.css":1,"modules\/node\/node.css":1,"sites\/all\/modules\/contrib\/uc_fedex\/uc_fedex.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_order\/uc_order.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_product\/uc_product.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_store\/uc_store.css":1,"sites\/all\/modules\/contrib\/views\/css\/views.css":1,"sites\/all\/modules\/contrib\/ckeditor\/css\/ckeditor.css":1,"sites\/all\/modules\/contrib\/uc_discounts_alt\/uc_discounts\/uc_discounts.css":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.css":1,"sites\/all\/modules\/contrib\/ctools\/css\/ctools.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.css":1,"sites\/all\/libraries\/shariff\/shariff.complete.css":1,"sites\/all\/themes\/nostarch\/css\/en_styles.css":1,"sites\/all\/themes\/nostarch\/css\/custom.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-vert-offset.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-autoclear.css":1,"sites\/all\/themes\/nostarch\/css\/glyphicons.css":1}},"colorbox":{"opacity":"0.85","current":"{current} of {total}","previous":"\u00ab Prev","next":"Next \u00bb","close":"Close","maxWidth":"98%","maxHeight":"98%","fixed":true,"mobiledetect":true,"mobiledevicewidth":"480px","file_public_path":"\/sites\/default\/files","specificPagesDefaultValue":"admin*\nimagebrowser*\nimg_assist*\nimce*\nnode\/add\/*\nnode\/*\/edit\nprint\/*\nprintpdf\/*\nsystem\/ajax\nsystem\/ajax\/*"},"better_exposed_filters":{"views":{"topics":{"displays":{"block":{"filters":[]}}},"related_products":{"displays":{"block":{"filters":[]}}}}},"googleanalytics":{"account":["UA-5027625-1","G-51XGZT9Y4H"],"trackOutbound":1,"trackMailto":1,"trackDownload":1,"trackDownloadExtensions":"7z|aac|arc|arj|asf|asx|avi|bin|csv|doc(x|m)?|dot(x|m)?|exe|flv|gif|gz|gzip|hqx|jar|jpe?g|js|mp(2|3|4|e?g)|mov(ie)?|msi|msp|pdf|phps|png|ppt(x|m)?|pot(x|m)?|pps(x|m)?|ppam|sld(x|m)?|thmx|qtm?|ra(m|r)?|sea|sit|tar|tgz|torrent|txt|wav|wma|wmv|wpd|xls(x|m|b)?|xlt(x|m)|xlam|xml|z|zip","trackColorbox":1},"urlIsAjaxTrusted":{"\/evading-edr":true},"bootstrap":{"anchorsFix":"0","anchorsSmoothScrolling":"0","formHasError":1,"popoverEnabled":1,"popoverOptions":{"animation":1,"html":0,"placement":"right","selector":"","trigger":"click","triggerAutoclose":1,"title":"","content":"","delay":0,"container":"body"},"tooltipEnabled":1,"tooltipOptions":{"animation":1,"html":0,"placement":"auto left","selector":"","trigger":"hover focus","delay":0,"container":"body"}}});</script> </head> <body class="html not-front not-logged-in two-sidebars page-node page-node- page-node-741 node-type-product uc-product-node"> <div id="skip-link"> <a href="#main-content" class="element-invisible element-focusable">Skip to main content</a> </div> <header id="" class="header" role="banner" class="navbar navbar-default"> <div class="container"> <div class="row"> <nav role="navigation" class="navbar navbar-default visible-xs"> <div class="navbar-header"> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand text-uppercase" href="/"><img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/></a> </div> <div id="navbar" class="navbar-collapse collapse text-center"> <ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/evading-edr" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-M0ilLoFQa9eSpZjq9lUkac_Em7jfntP8dhKR8eMJhZs" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </nav> <div class="navbar-header"> <div class="logo-wrapper col-sm-6 hidden-xs"> <a class="logo navbar-btn pull-left" href="/" title="Home"> <img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/> </a> </div> <div class="logo-wrapper col-sm-6 hidden-xs"> <div class="region region-navigation"> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/evading-edr" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-M0ilLoFQa9eSpZjq9lUkac_Em7jfntP8dhKR8eMJhZs" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </div> </div> </div> </div> <div class="container"> <div class="row"> <div class="navbar-collapse collapse"> <nav role="navigation"> <ul class="menu nav navbar-nav"><ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul></ul> </nav> </div> </div> </div> </header> <div class="main-container container"> <header role="banner" id="page-header"> <div class="region region-header"> <section id="block-block-159" class="block block-block clearfix"> <style> <![CDATA[/* ><!]]>*/ </style><div id="banner1"> <div class="banner-column" id="banner-graphic"> <p><a href="https://www.humblebundle.com/books/computer-science-fun-way-no-starch-books" target="_blank"><img src="https://nostarch.com/images/banners/HumbleBundleWebsiteBanner_March2025.png" class="banner_image" /></a></p> </div> <div class="banner-column" id="banner-countdown"> <div class="time-left">time left</div> <div class="countdown-container"> <div class="countdown-timer"> <div class="countdown-timer-counter" data-unit="days"> <div class="countdown-timer-number"></div> <div class="countdown-label">days</div> </div> <div class="countdown-timer-counter" data-unit="hours"> <div class="countdown-timer-number"></div> <div class="countdown-label">hours</div> </div> <div class="countdown-timer-counter" data-unit="minutes"> <div class="countdown-timer-number"></div> <div class="countdown-label">min</div> </div> <div class="countdown-timer-counter" data-unit="seconds"> <div class="countdown-timer-number"></div> <div class="countdown-label">sec</div> </div> </div> </div> </div> <div class="banner-column" id="banner-cta"><a href="https://www.humblebundle.com/books/computer-science-fun-way-no-starch-books" target="_blank"><span class="cta-button">Get The Bundle</span></a></div> </div> <script> <![CDATA[// ><!]]> </script> </section> </div> </header>  <div class="row"> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-first well"> <section id="block-views-topics-block" class="block block-views clearfix"> <button class="btn btn-primary btn-block visible-xs vert-offset-top-2" data-toggle="collapse" data-target="#topics"><span class="glyphicon glyphicon-menu-down pull-left"></span> <span class="btn-text">Topics</span><span class="glyphicon glyphicon-menu-down pull-right"></span></button> <h2 class="block-title hidden-xs">Topics</h2> <div id="topics" class="view-content collapse dont-collapse animateCollapse"> <div class="view view-topics view-id-topics view-display-id-block view-dom-id-529d4f25640bf82b8eec7b6e6c6d4898"> <div class="view-content"> <div class="item-list"> <ul> <li class="views-row views-row-1 views-row-odd views-row-first"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/art-photography-design">Art & Design</a></span> </div></li> <li class="views-row views-row-2 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/general-computing">General Computing</a></span> </div></li> <li class="views-row views-row-3 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/security">Hacking & Computer Security</a></span> </div></li> <li class="views-row views-row-4 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/hardware-and-diy">Hardware / DIY</a></span> </div></li> <li class="views-row views-row-5 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/kids">Kids</a></span> </div></li> <li class="views-row views-row-6 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/lego">LEGO®</a></span> </div></li> <li class="views-row views-row-7 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/linux-bsd-unix">Linux & BSD</a></span> </div></li> <li class="views-row views-row-8 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/manga">Manga</a></span> </div></li> <li class="views-row views-row-9 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/programming">Programming</a></span> </div></li> <li class="views-row views-row-10 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/python">Python</a></span> </div></li> <li class="views-row views-row-11 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/rforall">R for All</a></span> </div></li> <li class="views-row views-row-12 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/science-math">Science & Math</a></span> </div></li> <li class="views-row views-row-13 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/scratch">Scratch</a></span> </div></li> <li class="views-row views-row-14 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/system-administration">System Administration</a></span> </div></li> <li class="views-row views-row-15 views-row-odd views-row-last"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/early-access">Early Access</a></span> </div></li> </ul></div> </div> <div class="view-footer"> <style> <![CDATA[/* ><!]]>*/ </style> </div> </div> </div> </section><section id="block-block-12" class="block block-block clearfix"> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><span style="color:#c0392b"><a href="https://nostarch.com/about_ebooks.htm">FREE ebook edition with every print book purchased from nostarch.com!</a></span></span></strong></span></div> <p class="rtecenter"><span style="font-size:22px">+</span></p> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><a href="https://nostarch.com/early-access-program"><span style="color:#c0392b">EARLY ACCESS lets you read full chapters months before a title's release date!</span></a></span></strong></span></div> </section> <section id="block-nostarch-custom-login-block" class="block block-nostarch-customclearfix"> <h2 class="block-title">User login</h2> <ul> <li><a href="/user">Log in</a></a></li> <li><a href="/user/register">Create account</a></a></li> </ul> </section> <section id="block-block-78" class="block block-block clearfix"> <script data-account="eeqOpWOUyZ" src="https://cdn.userway.org/widget.js"></script> </section> </div> </aside>  <section class="col-sm-6" style=""> <a id="main-content"></a> <div class="region region-content"> <section id="block-system-main" class="block block-system clearfix"> <div class="ds-1col node node-product node-promoted view-mode-full clearfix"> <div class=""> <div class="field field-name-field-image-cache field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><div class="product-image"><div class="main-product-image"><a href="https://nostarch.com/sites/default/files/styles/uc_product_full/public/EvadingEDR_cover.png?itok=iVbWAbu5" title="Evading EDR cover" class="colorbox" rel="uc_image_0"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/uc_product/public/EvadingEDR_cover.png?itok=fZKYgSxh" alt="Evading EDR cover" title="Evading EDR cover" /></a></div></div></div></div></div><div class="field field-name-entity-title field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><h1 class="page-header">Evading EDR</h1></div></div></div><div class="field field-name-field-subtitle field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">The Definitive Guide to Defeating Endpoint Detection Systems</div></div></div><div class="field field-name-field-author field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">by Matt Hand</div></div></div><div class="field field-name-released-date field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even">September 2023, 312 pp.</div></div></div><div class="field field-name-field-isbn13 field-type-text field-label-inline clearfix clearfix"><div class="field-label">ISBN-13: </div><div class="field-items"><div class="field-item even">9781718503342</div></div></div><div class="add-to-cart"><form action="/evading-edr" method="post" id="uc-product-add-to-cart-form-741" accept-charset="UTF-8"><div><div id="uc_product_add_to_cart_form-741-attributes" class="attributes"><div class="attribute attribute-1 odd"><div class="form-item form-item-attributes-1 form-type-radios form-group"><div id="edit-attributes-1" class="form-radios"><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-3"><input type="radio" id="edit-attributes-1-3" name="attributes[1]" value="3" checked="checked" class="form-radio" />Print Book and FREE Ebook, $59.99</label> </div><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-2"><input type="radio" id="edit-attributes-1-2" name="attributes[1]" value="2" class="form-radio" />Ebook (PDF, Mobi, and ePub), $47.99</label> </div></div></div></div></div><input type="hidden" name="qty" value="1" /> <input type="hidden" name="form_build_id" value="form-uQfnKKAtG6-YIXobOnZ6aIRimTnkcyrPjnWPXTuOczA" /> <input type="hidden" name="form_id" value="uc_product_add_to_cart_form_741" /> <div class="form-actions form-wrapper form-group" id="edit-actions"><button class="node-add-to-cart btn btn-success form-submit icon-before" type="submit" id="edit-submit-741" name="op" value="Add to cart"><span class="icon glyphicon glyphicon-plus" aria-hidden="true"></span> Add to cart</button> </div></div></form></div><div class="field field-name-product-menu field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><div class="menu-wrapper"><ul class="menu nav"><li><a href="#content">Contents</a></li><li><a href="#reviews">Reviews</a></li><li><a href="#updates">Updates</a></li></ul></div></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p><a href="/download/EvadingEDR_chapter6.pdf" target="_blank" class="btn btn-success downloadbutton" style="font-weight: 400;">Download Chapter 6: FILESYSTEM MINIFILTER DRIVERS</a></p> <p><strong>Look Inside!</strong></p> <div class="lookinside"><a class="colorbox" href="/images/EvadingEDR_p2-3.png"><img alt="Evading EDR pages 2-3" src="/images/EvadingEDR_p2-3.png" style="border:1px solid; height:102px; margin:5px" title="Evading EDR pages 2-3" /></a><a class="colorbox" href="/images/EvadingEDR_p90-91.png"><img alt="Evading EDR pages 90-91" src="/images/EvadingEDR_p90-91.png" style="border:1px solid; height:102px; margin:5px" title="Evading EDR pages 90-91" /></a><a class="colorbox" href="/images/EvadingEDR_p172-173.png"><img alt="Evading EDR pages 172-173" src="/images/EvadingEDR_p172-173.png" style="border:1px solid; height:102px; margin:5px" title="Evading EDR pages 172-173" /></a></div> <div><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000">Nearly every enterprise uses an Endpoint Detection and Response (EDR) agent to monitor the devices on their network for signs of an attack. But that doesn't mean security defenders grasp how these systems actually work. This book demystifies EDR, taking you on a deep dive into how EDRs detect adversary activity. Chapter by chapter, you’ll learn that EDR is not a magical black box—it’s just a complex software application built around a few easy-to-understand components.</span></span></span></div> <div> </div> <div><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000">The author uses his years of experience as a red team operator to </span></span></span><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000"><span style="background-color:#ffffff">investigate each of the most common sensor components, discussing their purpose, explaining their implementation, </span></span></span></span><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000">and showing the ways they collect various data points from the Microsoft operating system. </span></span></span><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000"><span style="background-color:#ffffff">In addition to covering the theory behind designing an effective EDR</span></span></span></span><span style="font-size:10pt"><span style="font-family:Roboto,sans-serif"><span style="color:#000000">, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.</span></span></span></div> </div></div></div><div class="field field-name-field-author-bio field-type-text-long field-label-abovec"><div class="field-label">Author Bio </div><div class="field-items"><div class="field-item even"><p><strong>Matt Hand </strong>is an experienced red team operator with over a decade of experience. His primary areas of focus are in vulnerability research and EDR evasion where he spends a large amount of time conducting independent research, developing tooling, and publishing content. Matt is currently a Service Architect at SpecterOps where he focuses on improving the technical and execution capabilities of the Adversary Simulation team, as well as serving as a subject matter expert on evasion tradecraft.</p> </div></div></div><div class="field field-name-field-toc field-type-text-long field-label-abovec" id="content"><div class="field-label">Table of contents </div><div class="field-items"><div class="field-item even"><p><span style="color:#000000">Acknowledgements<br /> Introduction<br /> Chapter 1: EDR-chitecture<br /> Chapter 2: Function-Hooking DLLs<br /> Chapter 3: Process- and Thread-Creation Notifications<br /> Chapter 4: Object Notifications<br /> Chapter 5: Image-Load and Registry Notifications<br /> Chapter 6: Filesystem Minifilter Drivers<br /> Chapter 7: Network Filter Drivers<br /> Chapter 8: Event Tracing for Windows<br /> Chapter 9: Scanners<br /> Chapter 10: Anti-Malware Scan Interface<br /> Chapter 11: Early Launch Antimalware Drivers<br /> Chapter 12: Microsoft-Windows-Threat-Intelligence<br /> Chapter 13: Case Study: A Detection-Aware Attack<br /> Appendix: Auxiliary Sources</span><br /> </p> <p><a href="download/EvadingEDR_copyright.pdf" style="text-decoration:underline;" target="_blank"><strong>View the Copyright page</strong></a><br /> <a href="/download/EvadingEDR_detailedTOC.pdf" style="text-decoration:underline;" target="_blank"><strong>View the detailed Table of Contents</strong></a><br /> <a href="/download/EvadingEDR_index.pdf" style="text-decoration:underline;" target="_blank"><strong>View the Index</strong></a></p> </div></div></div><div class="field field-name-field-reviews field-type-text-long field-label-abovec" id="reviews"><div class="field-label">Reviews </div><div class="field-items"><div class="field-item even"><p>"A masterclass in understanding EDR internals...a very relevant handbook for both attackers and defenders to learn about the strengths, but also limitations and blind spots of EDR software."<br /><strong>—Arris Huijgen, @bitsadmin</strong></p> <p>"A great book for red and blue ppl! It is a great resource for anyone who wants to learn more about how EDRs work and Windows internals with a security perspective."<br /> <strong>—Olaf Hartong, @olafhartong, researcher at FalconForce</strong></p> <p>"If you spend any time around EDR's, or are just interested in how they work... this book is an invaluable addition to your collection."<br /> <em><strong>—</strong></em><strong>Adam Chester, @_xpn_, RedTeamer at TrustedSec</strong></p> </div></div></div><div class="field field-name-field-updates field-type-text-long field-label-abovec" id="updates"><div class="field-label">Updates </div><div class="field-items"><div class="field-item even"><p>View the <a href="/download/EvadingEDR_errata_p1.pdf" target="_blank" style="text-decoration:underline;"><u><b>latest errata</b></u></a>.</p> </div></div></div> </div> </div> </section> <section id="block-shariff-shariff-block" class="block block-shariff clearfix"> <div class="shariff" data-services="["facebook","print","twitter"]" data-theme="colored" data-orientation="horizontal" data-twitter-via="nostarch" data-lang="en"></div> </section> </div> </section> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-second"> <section id="block-system-navigation" class="block block-system block-menu clearfix"> <h2 class="block-title">Navigation</h2> <ul class="menu nav"><li class="first last leaf"><a href="/user" title="">My account</a></li> </ul> </section> <section id="block-block-52" class="block block-block clearfix"> <p><a href="/mailchimp/subscribe">Want sweet deals? <br />Sign up for our newsletter.</a></p> </section> <section id="block-views-related-products-block" class="block block-views clearfix"> <h2 class="block-title">You might also like...</h2> <div class="view view-related-products view-id-related_products view-display-id-block auto-clear view-dom-id-6d25ed3e24a7ce628ab6e4a6ed05c06c"> <div class="view-content"> <div class="views-row views-row-1 views-row-odd views-row-first col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/pentesting"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/pentest_cover-web.png?itok=PyM5MTMK" width="90" height="119" alt="Penetration Testing: A Hands-on Introduction to Hacking" title="Penetration Testing: A Hands-on Introduction to Hacking" /></a></div> </div> </div> <div class="views-row views-row-2 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/silence.htm"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/silence_big.jpg?itok=9DwY0WT_" width="90" height="119" alt="Silence on the Wire" title="Silence on the Wire" /></a></div> </div> </div> <div class="views-row views-row-3 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/bughunting"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/bughunting_frontcvr_rgb_REV2%20HM.png?itok=J6QvAzty" width="90" height="119" alt="Real-World Bug Hunting" title="Real-World Bug Hunting" /></a></div> </div> </div> <div class="views-row views-row-4 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/hacks-leaks-and-revelations"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/9781718503120.png?itok=VpbXiclC" width="90" height="118" alt="Hacks, Leaks, and Revelations cover" title="Hacks, Leaks, and Revelations cover" /></a></div> </div> </div> <div class="views-row views-row-5 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/crypto-dictionary"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/9781718501409.png?itok=v_q5cyhY" width="90" height="136" alt="Crypto Dictionary cover" title="Crypto Dictionary cover" /></a></div> </div> </div> <div class="views-row views-row-6 views-row-even views-row-last col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/metasploit-2nd-edition"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/metasploit2e_frontcover_0.png?itok=J6wOCovO" width="90" height="120" alt="Metasploit, 2nd Edition cover" title="Metasploit, 2nd Edition cover" /></a></div> </div> </div> </div> </div> </section> </div> </aside>  </div> </div> <footer class="footer container"> <div class="region region-footer"> <section id="block-block-16" class="block block-block clearfix"> <div id="footer-links"> <br> <a class="footer-links" href="/about.htm">About Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/Jobs.htm">Jobs!</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/distribution.htm">Sales and Distribution</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/rights">Rights</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/media.htm">Media</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/academic.htm">Academic Requests</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/conferences.htm">Conferences</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/orderfaq.htm">FAQ</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/contactus">Contact Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/writeforus">Write for Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/privacypolicy.htm">Privacy</a> </div> </section> <section id="block-nostarch-custom-custom-footer-copyright" class="block block-nostarch-custom clearfix"> <div class="block-block"> <p>Copyright 2025. No Starch Press, Inc</p> </div> </section> </div> </footer> <script src="https://nostarch.com/sites/all/modules/contrib/addthis/addthis.js?steosx"></script> <script src="https://nostarch.com/sites/all/libraries/shariff/shariff.min.js?steosx"></script> <script src="https://nostarch.com/sites/all/themes/contrib/bootstrap/js/bootstrap.js?steosx"></script>  <script> !function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','t2_6acpsf9y');rdt('track', 'PageVisit'); </script>   <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9233af968d3355ec',t:'MTc0MjQ1NzczMS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body> </html>