What Is an EDR?

fltmc.exe unload takes one line and about two seconds. If it succeeds against your endpoint agent's file system filter, the file telemetry stops and nothing in the console says so. That single command is the shortest argument for understanding what an EDR agent actually is, rather than what the datasheet calls it.

An EDR is three things packaged in one agent: a sensor that instruments the operating system, a detection engine that scores what the sensor produces, and a response channel that lets an analyst act on the host remotely. Teams that treat it as antivirus with a nicer dashboard use exactly one of the three.

What the sensor sees, and how

On Windows the sensor is mostly a kernel driver subscribing to documented notification callbacks. The core set is small and every vendor uses some subset of it.

• PsSetCreateProcessNotifyRoutineEx and PsSetCreateProcessNotifyRoutineEx2 for process start and exit

• PsSetLoadImageNotifyRoutine for executable and DLL image loads

• PsSetCreateThreadNotifyRoutine for thread creation, including remote threads

• CmRegisterCallbackEx for registry operations

• ObRegisterCallbacks for handle operations on process, thread and desktop objects

The process callback is not just an observer. Its PS_CREATE_NOTIFY_INFO structure carries ImageFileName, CommandLine, ParentProcessId, CreatingThreadId and an NTSTATUS CreationStatus field the driver can write to. Set that field to a failure status and the process never runs, synchronously, before CreateProcess returns to the caller.

ObRegisterCallbacks fires on handle create and duplicate, and the callback can strip requested access bits before the handle is granted. Removing PROCESS_VM_READ from a handle request against lsass.exe is the standard implementation of LSASS hardening, and it is why credential dumping tools fail with access denied on a hardened host despite running as SYSTEM. It maps to T1003.001.

Both have a hard registration requirement. PsSetCreateProcessNotifyRoutineEx returns STATUS_ACCESS_DENIED unless the driver image was linked with IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, and ObRegisterCallbacks returns the same if the callbacks do not sit in a signed kernel image.

Where callbacks stop and ETW starts

Callbacks cover process, thread, image, registry and handles. They do not cover memory operations, and they do not cover most of what happens inside a process after it starts. Event Tracing for Windows fills the gap.

Microsoft-Windows-Kernel-Process     ProcessStart, ImageLoad, ThreadStart
Microsoft-Windows-Kernel-Network     TCP and UDP connect, send, receive
Microsoft-Windows-Kernel-File        create, write, rename, delete
Microsoft-Windows-Threat-Intelligence  allocate, protect, map, remote thread
Microsoft-Windows-DNS-Client         3008 query completed
Microsoft-Windows-PowerShell         4104 script block logging
Microsoft-Antimalware-Scan-Interface AMSI buffer content

Microsoft-Windows-Threat-Intelligence, usually shortened to ETW-TI, is the interesting one. It emits from the kernel on the memory operations process injection depends on, which is exactly the T1055 surface callbacks miss. Subscribing to it is gated: the consuming process has to run as a protected process light with an anti-malware signature, which requires an Early Launch Anti-Malware driver and a Microsoft-issued ELAM certificate. That same protection is what stops an admin attaching a debugger to the agent service.

Not all ETW is equal. Security event 4688 for process creation is not a kernel event. The kernel hands the data to lsass.exe, which emits the ETW event the Event Log consumes, so the record passes through a user-mode service before it reaches you. ProcessStart from Microsoft-Windows-Kernel-Process is written by the kernel directly. The distinction matters because anything that interferes with the user-mode hop degrades 4688 without touching the kernel event.

File activity and the altitude problem

File events come from a minifilter driver registered through FltRegisterFilter. Every minifilter declares an altitude, an arbitrary-precision decimal that fixes its position in the I/O stack. Microsoft allocates them by load order group:

FSFilter Top                400000-409999
FSFilter Activity Monitor   360000-389999
FSFilter Anti-Virus         320000-329998
FSFilter Replication        300000-309998

Altitude is not trivia. A filter at 385000 sees an I/O operation before a filter at 325000 does. Run fltmc filters on any managed host and you can read the whole security stack off it, agents and backup software alike, in altitude order.

Some vendors still hook user-mode ntdll exports in every process for coverage the kernel does not give them cheaply. An in-process hook is patchable by the process it lives in, and refreshing a clean ntdll from disk or issuing indirect syscalls walks straight past it. The exact mix of callbacks, ETW, minifilter and userland hooks differs per product and per version, and no vendor publishes the full list. Test yours rather than assuming.

On Linux the modern sensor is eBPF, attached to tracepoints, kprobes and BPF LSM hooks, with auditd as the fallback on kernels too old for BPF LSM. On macOS third-party kernel extensions are gone and agents use Apple's Endpoint Security framework, which exposes ES_EVENT_TYPE_NOTIFY_* events for observation and ES_EVENT_TYPE_AUTH_* events where the client returns a verdict and the kernel blocks until it does.

The telemetry is the product, not the alerts

The vendor's detection content is one global ruleset tuned so the median customer does not drown. A service account that runs psexec nightly is normal in one estate and an incident in another, and no vendor rule knows which one you are.

Stream the raw process, network, module load and registry events into your SIEM and write your own logic on top. That is where asset context lives: tiering, ownership, change windows, the list of hosts where wmic is genuinely expected. Raw telemetry retention in a vendor console is usually shorter than alert retention, which is a second reason to hold the stream yourself. What a detection rule is covers the authoring side.

Response actions and what each one costs

• Network isolation. The host keeps a tunnel to the EDR console and loses everything else. Strongest containment available in one click, and on a domain controller, a hypervisor or a file server it takes dependent services with it. Isolation is reversed from the console only, so a console outage during an isolation strands the host.

• Kill process. Cheap and weak. A payload already injected elsewhere survives the kill, and killing a legitimate parent like services.exe bluescreens the box.

• Quarantine file. A false positive on a signed line-of-business executable becomes an application outage on every host that received the same verdict, at machine speed.

• Remote shell or live response. Highest fidelity, lowest scale, and every command changes the host you are collecting evidence from. Capture volatile state before you touch anything.

• Hash and IOC blocking. Trivial to deploy, trivial to defeat with a recompile. It buys hours, it is not the fix.

Where the sensor is blind

• No agent, no telemetry. Unmanaged contractor laptops, forgotten lab VMs, hosts where the installer failed silently. The gap between your asset inventory and your agent inventory is your real coverage figure.

• Legacy Windows. Vendors drop support for older kernels well before the estate does. We have not tested current agent builds on Server 2012 R2 and would not assume parity.

• Devices that cannot take an agent at all. Firewalls, switches, load balancers, hypervisor hosts, printers, OT controllers, most appliances. An attacker living on a VPN concentrator is invisible to every EDR you own.

• Tamper protection versus a local admin. Protected process light stops an admin injecting into the agent service. It does not stop a driver. Bring-your-own-vulnerable-driver tooling loads a signed but flawed driver and removes the callback entries from the kernel's notification arrays, after which the agent runs and reports healthy while receiving nothing. That is T1685. An admin can also filter the agent's egress with WFP so telemetry is generated and never delivered, which is also T1685.

• Evasion aims at the mechanism, not the rule. Unhooking ntdll, patching EtwEventWrite in-process, stopping the trace session, removing kernel callbacks. A perfect ruleset over a silenced sensor produces nothing.

What the rule catches

Sensor silence is the detection that pays for itself. Two of the cheapest ways to cause it are unloading the minifilter and stopping the service.

title: Minifilter unload or endpoint agent service stop
id: 3f0c9b41-6f9a-4a1e-9a0f-b7d2c4e85f11
status: experimental
description: Detects fltmc.exe unloading a file system filter, or sc.exe and net.exe stopping a named endpoint agent service.
references:
    - https://attack.mitre.org/techniques/T1685/
author: huntrule.com
date: 2026-07-31
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    fltmc_unload:
        Image|endswith: '\fltmc.exe'
        CommandLine|contains: 'unload'
    service_tool:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
        CommandLine|contains: 'stop'
    agent_service:
        CommandLine|contains:
            - 'WinDefend'
            - 'SysmonDrv'
            - 'Sense'
            - 'CSFalconService'
            - 'SentinelAgent'
    condition: fltmc_unload or (service_tool and agent_service)
falsepositives:
    - Agent upgrades and uninstalls run by IT in a maintenance window
    - Backup and imaging tools that unload filters for offline volume access
level: high

What it catches: the lazy version, run from a command line, on a host whose process telemetry still works.

What it misses: plenty. A renamed fltmc.exe slips the Image|endswith match, which is why OriginalFileName is the more durable field where your schema populates it. Anything that calls FilterUnload or ControlService through the API instead of spawning a binary produces no process event at all. And the rule depends on the sensor it is protecting, so a driver-level kill that happened first makes it silent by construction.

Known false positive: Sense as a substring matches Defender's own MsSense.exe and SenseCncProxy.exe paths and other unrelated strings in a command line. Anchor it to a service name argument or accept the noise and tune per estate.

Back the rule with a source that does not come from the agent. Service Control Manager writes to the System log independently:

7045  A service was installed in the system
7040  Service start type was changed
7036  Service entered the stopped or running state
Sysmon 6   Driver loaded, with signature status
Sysmon 25  Process tampering, image replaced

Rules covering endpoint tampering and process injection live under the Windows domain in the catalog.

ATT&CK techniques referenced

Summary

An EDR agent is a kernel sensor, a detection engine and a remote response channel, and the three are worth separating because they fail separately. The sensor is built from documented mechanisms: process and object callbacks, ETW providers including the PPL-gated Threat Intelligence provider, and a minifilter at a known altitude. Each has a specific evasion aimed at it. Response actions are all reversible on paper and expensive in practice, so decide the blast radius of isolation and quarantine before an incident forces it. The vendor's alerts are a floor. Ship the raw telemetry to a SIEM you control, write rules against your own environment's normal, and treat the agent's silence as a detection in its own right.

Collect for endpoint tamper coverage:
  Sysmon 1, 6, 7, 8, 10, 11, 25
  Security 4688 with command line auditing enabled
  System 7036, 7040, 7045 (Service Control Manager)
  EDR raw process, module load, network and registry streams
  Agent heartbeat and last-seen, joined against the asset inventory