• $2,100 or 10 monthly payments of $220

EDR Internals – Research & Development

  • Course
  • 135 Lessons
  • Discord access

Master modern EDR internals with our cutting-edge recorded training for cybersecurity pros, red teamers, malware analysts, developers, and detection engineers. Learn at your own pace as Pavel Yosifovich and Uriel Kosayev unpack Windows internals, kernel development, detection logic, telemetry pipelines, and real-world EDR bypass techniques through clear, practical demonstrations.

Read more about the instructors, course contents and special pricing:

Contents

Course Materials

Labs Deployment Guide
EDR_Research_and_Developmet.pdf
EDR_Internals_Research_and_Development_Labs.pdf
EDR Research Methodology.pdf
EDR Assessment Report.pdf
Process Injection Poster - 1.pdf
Process Injection Poster - 2.pdf

Module 1: EDR Fundamentals

This module establishes the core technical foundations required for understanding, analyzing, and developing Endpoint Detection and Response systems. Students begin by exploring what EDR solutions are designed to detect, how they are architected, and the role of static, dynamic and heuristic engines. The module breaks down how modern enterprise security products evaluate files, monitor behavior, classify suspicious activity, generate alerts and enforce protection logic.

Students learn the structure of Microsoft Defender for Endpoint as a representative enterprise EDR. This includes the components responsible for scanning, behavioral monitoring, real time analysis, heuristic correlation, and how the system maps detection events to the MITRE ATT&CK framework. The module also guides students through navigating the MDE portal, understanding alerts, incidents, device views and execution artifacts.

A significant part of the module introduces students to the Windows internals knowledge required to understand detection logic and telemetry sources. This includes Windows architecture, processes and threads, handles, virtual memory, the registry, services, x64 architecture and assembly, the Windows calling convention, driver fundamentals and Event Tracing for Windows. These building blocks form the base for analyzing EDR behavior, simulating malicious techniques, and later developing custom detections or bypasses.

By the end of this module, students will understand how EDR engines function, what telemetry they use, how detections are structured, and how Windows internals concepts relate to EDR visibility. Students will also configure and explore the MDE console, review scan processes, and write an initial custom detection rule.

0 - Introduction to the Course
Preview
1 - Introduction to EDR Systems
Preview
2 - EDR Architecture
3 - The Static Engine
4 - The Dynamic Engine - Part 1
5 - The Dynamic Engine - Part 2
6 - The Heuristic Engine
7 - MDE Console Introduction
8 - The ATT&CK MITRE Framework
9 - Discovering the Static Engine Scanner Process
10 - Writing a Custom Detection Rule
11 - Windows Internals Overview
12 - The Registry
13 - Introduction to Services
14 - x64 Architecture and Assembly
15 - x64 Calling Convention
16 - Device Drivers
17 - More x64 Assembly
18 - Introduction to ETW

Module 2: EDR Research Methodology and Practical Analysis

In this module, students will move from conceptual understanding into structured, hands on EDR research. Students will learn how to design and execute EDR research using a repeatable methodology, prepare clean research environments, gather meaningful telemetry, and analyze real EDR implementations. The module combines OpenEDR and Microsoft Defender for Endpoint (MDE) to demonstrate differences in maturity, protection mechanisms, and telemetry pipelines, and introduces foundational EDR component reverse engineering techniques.

1 - Introduction to EDR Research
2 - EDR Research Methodology
3 - OpenEDR Deployment
4 - OpenEDR Research Lead Gathering - Part 1
5 - OpenEDR Research Lead Gathering - Part 2
6 - Dancing with OpenEDR's Anti-Tampering Mechanism - Part 1
7 - Dancing with OpenEDR's Anti-Tampering Mechanism - Part 2
8 - MDE Configuration Overview
9 - Dancing with MDE's (Defender for Enterprise) Anti-Tampering Mechanism - Part 1
10 - Dancing with MDE's (Defender for Enterprise) Anti-Tampering Mechanism - Part 2
11 - EDR Testing Reports Overview - Part 1
12 - EDR Testing Reports Overview - Part 2
13 - EDR Testing Reports Overview - Part 3
14 - MDE EDR Component Reverse Engineering - Part 1
15 - MDE EDR Component Reverse Engineering - Part 2
16 - MDE EDR ETW Analysis using PerfView
Preview
17 - MDE EDR PPL Bypass & Reverse Engineering - Part 1
18 - MDE EDR PPL Bypass & Reverse Engineering - Part 2

Module 3: Building EDR: Foundations

Students will learn how the “development side” of an EDR is structured, with emphasis on Windows services and drivers as core building blocks, how they are configured and operated, and what practical engineering guidelines matter when writing user-mode EDR components.

1 - EDR Components
2 - Service and Driver Configuration
3 - Service Operation
Preview
4- Service Code Demo
5- More on Services
6- General Programming Guidelines

Module 4: Basic Kernel Driver

In this module, students will begin hands-on kernel-mode development with a focus on building the foundational knowledge required to understand and implement EDR kernel components. Students will learn core Windows kernel programming concepts, memory management, object handling, driver structure, and communication between kernel-mode drivers and user-mode clients. The module incrementally builds from low-level primitives to a complete, testable driver, emphasizing correctness, stability, and security.

1 - Kernel Programming Basics
2 - Nt vs. Zw Functions
3 - Functions and Error codes
4 - Strings
5- Dynamic Memory Allocation
6- Dynamic Memory AllocationDemo
7 - Tagging Memory
8 - Driver Installation and Debugging
9 - Linked Lists
10 - Asserts and Tracing
11 - Handles and Objects
12 - Object Attributes
13 - Anatomy of a Driver
14 - Device and Driver Objects
Preview
15 - Creating a Device Object
16 - Securing Device Objects
17 - Symbolic Links
18 - A User Mode Client
19 - Completing the Driver
20 - Testing the Driver
21 - Debugging the Driver
22 - IRQLs

Module 5: Working with IRPs

In this module, students will deepen their understanding of I/O Request Packets (IRPs) as the core mechanism used by Windows drivers to receive requests and communicate with user-mode clients. Students will learn how dispatch routines are structured and invoked, how to reason about execution context when handling requests, and how to access user-mode buffers safely from kernel mode. The module then shifts to the most common EDR-style communication path: DeviceIoControl and IOCTL-style requests, including how different buffer management methods influence data flow between user mode and the driver.

1 - IRPs
Preview
2 - Dispatch Routines
3 - Referencing User Buffers
4 - DeviceIoControl Buffers
5 - DeviceIoControl Demo

Module 6: Kernel Notifications and Callbacks

Students will learn the “core mechanics” of an EDR kernel driver: collecting telemetry via kernel callbacks (process, thread, image load, object, and registry), correlating events with driver-maintained state, and coordinating decisions with user mode when analysis should not live in the kernel. Students will also learn the synchronization primitives needed to build safe, high-performance callback code paths that run system-wide.

1 - Process Notifications
2 - Communication with User Mode
Preview
3 - Process Notifications Demo
4 - Managing Proceses with Linked Lists
5 - Using an Event Object for User Kernel Notifications
6 - Tables
7 - Synchronization
8 - The Interlocked Functions
9 - Dispatcher Objects
10 - Using a Mutex
11 - Automatic Cleanup
12 - Fast Mutexes
13 - Events
14 - Executive Resources
15 - Spinlocks
16 - Thread Callbacks
17 - Image Load Callbacks
18 - Object Callbacks
19 - Q and A
20 - Registry Callbacks

Module 7: File System Mini-Filters

In this module, students will learn how file system mini-filters are used as a core visibility and enforcement mechanism in Endpoint Detection and Response systems. Students will understand why mini-filters are essential for monitoring file system activity, how they integrate into the Windows I/O stack, and what types of file operations are observable through them. The module introduces mini-filter architecture, registration and attachment concepts, and demonstrates how mini-filters can be used to collect security-relevant telemetry for detection and response. Students will also learn how file system behavior, such as alternate data streams and file access patterns, can be leveraged by attackers and detected by EDR solutions using mini-filters.

1 - Introduction to File System Mini-Filters
Preview
2 - Minifilter Registration
3 - Pre and Post Callbacks
4 - Filenames
5 - Contexts
6 - File Data and User Buffers
7 - Filter Communication Ports
8 - Debugging Minifilters

Module 8: EDR Bypass and Evasion

In this module, students will deepen their understanding of file system mini-filters by focusing on advanced behavior, real-world usage patterns, and practical considerations relevant to EDR development and research. Students will learn how mini-filters observe and interact with file system operations at different stages, how filter ordering and altitude affect visibility and enforcement, and how common file system techniques are abused by attackers. The module emphasizes how EDR solutions leverage mini-filters to detect malicious activity, handle complex file access scenarios, and balance visibility with performance and stability in production environments.

1 - Introduction to EDR Bypass & Evasion
2 - FUD Malware vs. Targeted EDR Bypass Malware
3 - Rename Obfuscation - Part 1
4 - Rename Obfuscation - Part 2
Preview
5 - Rename Obfuscation - Part 3
6 - Contrrol-flow Obfuscation - Part 1
7 - Control-flow Obfuscation - Part 2
8 - Code & Strings Runtime Decryption - Part 1
9 - Code & Strings Runtime Decryption - Part 2
10 - Dynamic API Resolve - Part 1
11 - Dynamic API Resolve - Part 2
12 - Dynamic API Resolve - Part 3
13 - Process Injection - Part 1
14 - Process Injection - Part 2
15 - APC Injection using Direct Syscalls
16 - Memory Bombing
17 - NTDS Stealer.mp4

Module 9: Detection Techniques

In this module, students will learn how EDR detection engines operate at a conceptual and practical level. Students will explore how telemetry collected from the operating system is transformed into detection signals, how rule-based logic differs from behavioral and heuristic approaches, and where machine learning may or may not be applicable in real EDR products. The module discusses practical detection challenges, including hooking considerations, tradeoffs between accuracy and performance, and why detection logic must be designed to operate reliably under adversarial conditions. Students will gain a realistic understanding of what modern EDR detection engines actually do, rather than idealized models.

1 - Introduction
2 - Detection Engine
3 - Machine Learning and AI
4 - Kernel Callbacks
Preview
5 - Hooking
6 - Other Techniques

Module 10: The Future of EDRs

In this module, students will examine the practical limitations of EDRs and the realities of bypass research. Students will learn why many EDR protections are constrained by stability, compatibility, and performance requirements, and how these constraints shape both defensive design and offensive research. The module discusses bypass thinking at a high level, including how attackers probe detection logic, why some protections are intentionally partial, and how research findings should be interpreted responsibly. Students will leave with a grounded perspective on EDR strengths and weaknesses, emphasizing understanding over exploitation.

1 - Known DLL Q and A
2 - Hypervisors Overview
3 - The Rings
Preview
4 - Virtualization Based Security
5 - Hypervisor Power
6 - Other Ideas
7 - Final Thoughts and Summary