What is EDR?

Endpoint detection and response tools run an agent on each workstation and server that records detailed activity, such as process launches with command lines, file writes, registry changes and network connections, and sends it to a central console. They detect suspicious behaviour and let responders isolate a machine or kill a process remotely.

EDR telemetry is often the richest source for investigations and threat hunting. Attackers know this, and some deliberately try to disable or blind EDR agents before doing anything noisy.