# Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)

DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)](<https://devfeed.tech/articles/lets-create-an-edr-and-bypass-it-part-1-32629.md>)

Original publisher: [Read original article](<https://ethicalchaos.dev/2020/05/27/lets-create-an-edr-and-bypass-it-part-1/>)

Author: CCob

Published: 2020-05-27T18:50:50Z

Content type: tutorial

Language: en

Sources: [Ethical Chaos](<https://devfeed.tech/sources/ethical-chaos.md>)

Topics: [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [virtual machines](<https://devfeed.tech/topics/virtual-machines.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [antivirus](<https://devfeed.tech/tags/antivirus.md>), [api](<https://devfeed.tech/tags/api.md>), [av](<https://devfeed.tech/tags/av.md>), [binaries](<https://devfeed.tech/tags/binaries.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [edr](<https://devfeed.tech/tags/edr.md>), [hooking](<https://devfeed.tech/tags/hooking.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [trampoline](<https://devfeed.tech/tags/trampoline.md>), [virtual-machines](<https://devfeed.tech/tags/virtual-machines.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow.

## Source excerpt

A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.