A tool called 'defendnot' disables Windows Defender by registering a fake antivirus through undocumented Windows Security Center APIs. Huntress covers the technique and how to detect it.

EDR is simply named but far from simple when you dig into how vendors actually implement it. Huntress cuts through the noise to explain what EDR looks like under the hood and what actually matters when evaluating it.