# Endpoint Security & XDR Cybersecurity practices and tools for protecting computing endpoints and consolidating detection and response across endpoint, network, and other security telemetry. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The only perfect Endpoint Prevention and Response (EPR) score in 2026 belongs to Elastic DevFeed: [The only perfect Endpoint Prevention and Response (EPR) score in 2026 belongs to Elastic]() Original publisher: [Read original article]() Author: Mia LaVada Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Endpoint Security & XDR](), [Testing](), [Security](), [SOC]() Tags: [2026](), [alert-fatigue](), [analysts](), [investigation-incident-response-security-compliance-security-analytics-xdr](), [obfuscation](), [persistence](), [protection](), [security](), [security-endpoint-security](), [soc](), [techniques](), [testing](), [tooling](), [usb]() ### AI overview Elastic describes its results in the 2026 AV-Comparatives Endpoint Prevention and Response test, reporting 100% protection scores, zero false alerts, and the lowest modeled operational footprint among tested products. The article explains that Elastic stopped all 50 attack scenarios at the initial phase. ### Source excerpt Elastic sits at the very top of this year's AV-Comparatives' CyberRisk Quadrant within the 2026 Endpoint Prevention and Response (EPR) test with the highest protection scores at 100%. Learn more. ## CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks DevFeed: [CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks]() Original publisher: [Read original article]() Author: Anne Aarness - Chris Prall Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [Endpoint Security & XDR](), [supply-chain-security](), [Security](), [Open Source](), [Software](), [Artificial Intelligence](), [Claude](), [codex]() Tags: [agentic](), [ai](), [codex](), [credential-theft](), [developer](), [developers](), [development](), [endpoint-security-xdr](), [malicious-packages](), [open-source](), [open-source-packages](), [persistence](), [security](), [software-supply-chain](), [supply-chain]() ### AI overview The article describes CrowdStrike's Real-Time Supply Chain Attack Protection, embedded in the Falcon sensor, which detects and blocks malicious open-source packages before their code executes on enterprise endpoints. It explains how AI-assisted and agentic applications have expanded software supply chain risk beyond developer workstations to endpoints across the organization. ### Source excerpt Real-Time Supply Chain Attack Protection, embedded into the Falcon sensor, blocks malicious open-source packages at download to protect the endpoint. ## The hidden work of modernizing Malwarebytes DevFeed: [The hidden work of modernizing Malwarebytes]() Original publisher: [Read original article]() Author: Anna Tukhtarova Published: 2026-09-04T17:15:42Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [.NET](), [migration](), [Endpoint Security & XDR](), [Operating system]() Tags: [diagnostics](), [drivers](), [endpoint-security](), [engineering](), [inside-malwarebytes](), [migration](), [modernization](), [net](), [security]() ### AI overview The article explains Malwarebytes' migration of its managed Windows components to .NET 10 and why runtime and dependency upgrades require security-feature-level rigor in endpoint software. ### Source excerpt Why disciplined dependency modernization is one of the highest-leverage engineering investments a security product can make. ## Counterfeit installers to system compromise: Tracking a deceptive software download campaign DevFeed: [Counterfeit installers to system compromise: Tracking a deceptive software download campaign]() Original publisher: [Read original article]() Author: Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar Published: 2026-09-01T22:48:28Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Malware](), [Endpoint Security & XDR](), [C2](), [Microsoft]() Tags: [china](), [defender](), [malware](), [microsoft](), [persistence](), [security](), [techniques](), [telemetry]() ### AI overview Microsoft documents an active malware campaign that uses counterfeit software-download pages and malicious installers to compromise systems. It outlines the attack chain, Defender XDR detection and disruption, and mitigations for blocking untrusted downloads and strengthening endpoint protections. ### Source excerpt An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat. The post Counterfeit installers to system compromise: Tracking a deceptive software download campaign appeared first on Microsoft Security Blog. ## The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution DevFeed: [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution]() Original publisher: [Read original article]() Author: Sara McBroom Published: 2026-08-25T10:00:57Z Content type: article Language: en Sources: [Unit 42]() Topics: [Malware](), [Artificial Intelligence](), [Security](), [Endpoint Security & XDR](), [VirusTotal](), [dataset](), [data](), [ChatGPT](), [ransomware](), [Cryptocurrency]() Tags: [agentic](), [ai](), [analysis](), [article](), [backdoor](), [bitcoin](), [code](), [cryptocurrency](), [data](), [dll-hijacking](), [malware](), [ransomware](), [research](), [sandbox](), [security](), [threat-research](), [virustotal]() ### AI overview Unit 42 analyzes 405 malware samples incorporating AI through mechanisms such as brand impersonation, LLM-generated code, and agentic execution loops. The research finds that most samples remain proof-of-concept or sandbox activity, while existing behavioral detection, cloud sandboxing, and endpoint analytics can detect the threats that reach operational environments. ### Source excerpt Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42. ## Bring your security stack into Edge for Business -- with support for more partners DevFeed: [Bring your security stack into Edge for Business -- with support for more partners]() Original publisher: [Read original article]() Author: Microsoft Edge Team Published: 2026-08-04T16:00:24Z Content type: article Language: en Sources: [Microsoft Edge Blog]() Topics: [Edge for Business](), [browser](), [Cisco Secure Access](), [Security](), [Endpoint Security & XDR](), [MFA](), [telemetry](), [Microsoft]() Tags: [browser](), [cisco-secure-access](), [edge-for-business](), [endpoint-security](), [integrations](), [mfa](), [microsoft](), [security](), [telemetry](), [uncategorized]() ### AI overview This Microsoft Edge Blog article announces expanded Edge for Business security connector integrations. It highlights Cisco Secure Access, Tanium, and Clever integrations for browser-based security, telemetry, endpoint visibility, compliance validation, data protection, AI guardrails, and streamlined MFA in education environments. ### Source excerpt At a glance Edge for Business security connectors extend your security tools into the browser, so you gain visibility and enforcement where work happens. This update adds new partner integrations, including Cisco Secure Access, The post Bring your security stack into Edge for Business -- with support for more partners appeared first on Microsoft Edge Blog. ## ESET Threat Report H1 2026 DevFeed: [ESET Threat Report H1 2026]() Original publisher: [Read original article]() Author: Jiří Kropáč Published: 2026-07-08T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Threat Research](), [Artificial Intelligence](), [Generative AI](), [Malware](), [Android](), [ClickFix](), [QR Code](), [ransomware](), [Social engineering](), [Endpoint Security & XDR](), [Security]() Tags: [ai](), [android](), [clickfix](), [code](), [eset-research](), [generative-ai](), [malware](), [ransomware](), [research](), [security](), [social-engineering](), [threat-report]() ### AI overview ESET's H1 2026 threat report describes attackers adapting established techniques across new platforms and behaviors. It highlights the expanding abuse of AI skills, PromptSpy Android malware using Google Gemini, the spread of ClickFix and QR-code phishing, and continued ransomware activity involving EDR killers. ### Source excerpt A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts. ## Killing me gently: Inside Gentlemen's EDR killer framework DevFeed: [Killing me gently: Inside Gentlemen's EDR killer framework]() Original publisher: [Read original article]() Author: Jakub Souček Published: 2026-06-18T09:46:32Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Endpoint Security & XDR](), [ransomware](), [Security](), [Cybercrime](), [Software]() Tags: [analysis](), [eset-research](), [europe](), [insights](), [ransomware](), [research](), [security](), [software](), [southeast-asia](), [techniques]() ### AI overview ESET Research analyzes Gentlemen's ransomware-as-a-service operation and its portfolio of EDR-killing tools. The article examines the in-house GentleKiller framework, third-party tools, shared defense-evasion techniques, and the group's rapid adoption of BYOVD exploits, using incident-level visibility and leaked internal data. ### Source excerpt ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen ## Кто выпустил гончую. Ищем следы коллекторов BloodHound в логах Windows DevFeed: [Кто выпустил гончую. Ищем следы коллекторов BloodHound в логах Windows]() Original publisher: [Read original article]() Author: StepVolg ("Лаборатория Касперского") Published: 2026-04-24T12:37:53Z Content type: tutorial Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [Endpoint Security & XDR](), [Windows](), [SOC]() Tags: [active-directory](), [bloodhound](), [enumerate](), [red-teaming](), [sharphound](), [siem](), [soc](), [windows](), [windows-1ad1db2b7e3a]() ### AI overview The article examines traces left by BloodHound collectors in Windows logs and discusses detecting Active Directory reconnaissance activity. ### Source excerpt Служба каталогов Active Directory остается одной из самых популярных целей как среди злоумышленников, так и среди специалистов по Red Teaming и пентестеров. С выходом новых версий операционных систем семейства Windows продолжают появляться новые векторы атак на AD, например атаки на Delegated Managed Service Accounts (dMSA) в 2025-м. В ходе каждой атаки есть этап сбора информации, обнаружение которого является более сложной задачей, чем кажется на первый взгляд. Согласно аналитическому отчету нашего сервиса MDR за 2025 год в целом обнаружение данного этапа атак затруднено из-за большого количества ложных срабатываний, что снижает качество обнаружения и уменьшает вероятность предотвращения атаки, особенно в больших инфраструктурах с тысячами активов. Меня зовут Степан Ляхов, я работаю старшим инженером SOC в "Лаборатории Касперского". В этой статье я хочу рассмотреть один из самых популярных инструментов для сбора информации о домене Active Directory, разобрать, какие следы он оставляет в журналах и как обнаружить его активность. Читать далее ## EDR killers explained: Beyond the drivers DevFeed: [EDR killers explained: Beyond the drivers]() Original publisher: [Read original article]() Author: Jakub Souček Published: 2026-03-19T09:55:08Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Endpoint Security & XDR](), [ransomware](), [Cybercrime](), [Encryption](), [telemetry](), [1Password in the browser]() Tags: [development](), [encryption](), [eset-research](), [ransomware](), [research](), [techniques](), [telemetry]() ### AI overview ESET researchers analyze nearly 90 EDR killers used in real ransomware intrusions, examining vulnerable-driver, anti-rootkit, script-based, and driverless approaches to disabling endpoint protection. The article explains how affiliates select and adapt these tools, why driver-based attribution can mislead, and how commercialized kits increase defense complexity. ### Source excerpt ESET researchers dive deeper into the EDR killer ecosystem, disclosing how attackers abuse vulnerable drivers ## Seeking symmetry during ATT&CK® season: How to harness today's diverse analyst and tester landscape to paint a security masterpiece DevFeed: [Seeking symmetry during ATT&CK® season: How to harness today's diverse analyst and tester landscape to paint a security masterpiece]() Original publisher: [Read original article]() Author: Márk Szabó James Shepperd Ben Tudor Published: 2025-12-10T15:03:51Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Endpoint Security & XDR](), [Cybersecurity](), [Resilience](), [Detection engineering](), [Threat Research]() Tags: [2025](), [analysts](), [article](), [attacks](), [business-security](), [ciso](), [cybersecurity](), [endpoint-security](), [enterprise](), [incident](), [industry](), [infrastructure](), [practitioner](), [report](), [resilience](), [security](), [testing]() ### AI overview The article explains how security practitioners can interpret and connect cybersecurity reports and tests from analyst firms and independent testing labs. It focuses on endpoint security, including product evaluations, feature testing, broader market analyses, and assessments against known advanced adversary attacks, to support more informed protection-stack and purchasing decisions. ### Source excerpt Interpreting the vast cybersecurity vendor landscape through the lens of industry analysts and testing authorities can immensely enhance your cyber-resilience. ## Designing for security and usability: Figma's modern endpoint strategy DevFeed: [Designing for security and usability: Figma's modern endpoint strategy]() Original publisher: [Read original article]() Author: Lamarr Henry Published: 2025-04-04T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Endpoint Security & XDR](), [Security](), [Usability](), [User experience (UX)](), [macOS]() Tags: [browsers](), [endpoint-security](), [macos](), [malware-prevention](), [security](), [usability](), [ux]() ### AI overview Figma describes an endpoint security strategy designed around usability. Its Endpoint Security Baseline uses controls such as browser updates, disabled remote login, and prevention of kernel extensions to protect corporate devices while keeping security self-serve and minimizing employee friction. ### Source excerpt At Figma, security doesn't have to slow you down. We've designed our corporate endpoint security with UX in mind, making it seamless and self-serve. ## What caused 8.5 million Windows computers to crash in the CrowdStrike Falcon incident DevFeed: [What caused 8.5 million Windows computers to crash in the CrowdStrike Falcon incident]() Original publisher: [Read original article]() Author: Richard Oliver Bray Published: 2024-08-28T13:00:58Z Content type: article Language: en Sources: [Hacking Scale by Better Stack]() Topics: [Security](), [Endpoint Security & XDR](), [Windows](), [Kernel](), [Machine learning]() Tags: [endpoint-security](), [kernel](), [machine-learning](), [security](), [windows]() ### AI overview This article explains how a CrowdStrike Falcon software issue caused 8.5 million Windows machines to crash on July 19, 2024. It describes Falcon's endpoint-security architecture, including cloud servers, machine-learning analysis, threat intelligence, and kernel-level sensors. ### Source excerpt How one security product crippled the world because of bad programming ## Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2) DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion (Part 2)]() Original publisher: [Read original article]() Author: bohops Published: 2022-08-22T23:48:27Z Content type: article Language: en Sources: [Bohops]() Topics: [.NET](), [Endpoint Security & XDR](), [Processes](), [Windows](), [SIEM, Security, Observability]() Tags: [assembly](), [code](), [events](), [logs](), [monitoring](), [net](), [powershell](), [processes](), [research](), [uncategorized]() ### AI overview This article revisits .NET CLR Usage Logs and examines two additional tampering techniques that can prevent log creation, including discretionary ACL blocking. It also discusses how monitoring Usage Log creation events can help identify suspicious processes that loaded the .NET CLR. ### Source excerpt Introduction Last year, I blogged about Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion. In that part 1 post, we covered: Recently, I revisited the research topic to close the loop on some outstanding research and figured I would share. In this post, we'll recap .NET Usage Logs, highlight two other tampering techniques, [...] ## Unmanaged Code Execution with .NET Dynamic PInvoke DevFeed: [Unmanaged Code Execution with .NET Dynamic PInvoke]() Original publisher: [Read original article]() Author: bohops Published: 2022-04-02T16:45:49Z Content type: tutorial Language: en Sources: [Bohops]() Topics: [.NET](), [C#](), [Code](), [Endpoint Security & XDR]() Tags: [c-sharp](), [code](), [endpoint-security](), [interop](), [native](), [net](), [security](), [uncategorized]() ### AI overview This developer article explains classic P/Invoke in .NET and introduces Dynamic PInvoke, a technique for calling and executing native code differently from managed code. It discusses limitations, .NET executable structure, and possible defensive-evasion implications. ### Source excerpt Yes, you read that correctly - "Dynamic Pinvoke" as in "Dynamic Platform Invoke" Background Recently, I was browsing through Microsoft documentation and other blogs to gain a better understanding of .NET dynamic types and objects. I've always found the topic very interesting mainly due to its relative obscurity and the offensive opportunities for defensive evasion. [...] ## Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion DevFeed: [Investigating .NET CLR Usage Log Tampering Techniques For EDR Evasion]() Original publisher: [Read original article]() Author: bohops Published: 2021-03-16T04:08:58Z Content type: article Language: en Sources: [Bohops]() Topics: [Endpoint Security & XDR](), [Logging](), [.NET](), [Security](), [Threat Hunting & Intel](), [Machine Learning, Security Attacks]() Tags: [code](), [endpoint-security](), [logging](), [net](), [process](), [processes](), [security](), [uncategorized]() ### AI overview This article examines how .NET CLR Usage Logs can help defenders detect and investigate .NET execution, including assembly injection into process memory. It describes how the CLR creates Usage Log files and discusses tampering techniques intended to evade endpoint detection, along with monitoring opportunities for identifying that tampering. ### Source excerpt Introduction In recent years, there have been numerous published techniques for evading endpoint security solutions and sources such as A/V, EDR and logging facilities. The methods deployed to achieve the desired result usually differ in sophistication and implementation, however, effectiveness is usually the end goal (of course, with thoughtful consideration of potential tradeoffs). Defenders can [...] ## EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls DevFeed: [EDR Bypass Methods: Blending In, Unhooking, and Direct Syscalls]() Original publisher: [Read original article]() Author: CCob Published: 2020-06-14T10:47:09Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [Endpoint Security & XDR](), [Code](), [API](), [Processes]() Tags: [antivirus](), [api](), [av](), [boilerplate](), [bypass](), [cobalt-strike](), [code](), [edr](), [hooking](), [process](), [sharpblock](), [trampoline]() ### AI overview This tutorial examines methods for bypassing an active-protection EDR, including avoiding suspicious RWX memory changes, unhooking API calls, and using direct syscall instructions. It also introduces SharpBlock and accompanying code. ### Source excerpt A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part 2 I introduce SharpBlock, a method of bypassing EDR's. The post Lets Create An EDR... And Bypass It! Part 2 appeared first on Ethical Chaos. ## Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1) DevFeed: [Creating a Basic EDR: Detection Methods and Sandbox Bypass Concepts (Part 1)]() Original publisher: [Read original article]() Author: CCob Published: 2020-05-27T18:50:50Z Content type: tutorial Language: en Sources: [Ethical Chaos]() Topics: [Endpoint Security & XDR](), [Malware](), [virtual machines](), [Kernel](), [Windows]() Tags: [analysis](), [antivirus](), [api](), [av](), [binaries](), [bypass](), [edr](), [hooking](), [how-to](), [implementation](), [kernel](), [malware](), [sandbox](), [trampoline](), [virtual-machines](), [windows]() ### AI overview Part one explains how a basic EDR detects malicious files and behavior through signature detection, kernel-level file system filters, sandboxing, and dynamic analysis. It also introduces sandbox bypass concepts involving analysis time limits and disrupted control flow. ### Source excerpt A 2 part series on creating a basic EDR detection system and then a bypass implementation. In part one we cover how to create a basic EDR. The post Lets Create An EDR... And Bypass It! Part 1 appeared first on Ethical Chaos.