EDR Courses and Certifications

EDR Internals – Research & Development (Live)

1 rating

Learn how EDR solutions work and build them: research EDR internals, bypass detection with obfuscation and process injection, engineer kernel drivers with ETW and minifilters, and implement threat analytics.

• TrainSec
• 40 hours
• Self-Paced
• Paid Course

Learn to install and configure QRadar EDR, deploy endpoint agents, and investigate endpoint threats through its dashboard.

• IBM Training
• 2 hours
• Self-Paced
• Free Online Course

CrowdStrike: Zero to Falcon Admin

3718 ratings at Udemy

Disclaimer: This course offered independently by Blue Team Consulting, LLC and is not affiliated with CrowdStrike, Inc.

• Udemy
• 4 hours 4 minutes
• Self-Paced
• Paid Course

Packt

Endpoint Detection and Response Essentials

Deploy EDR/XDR tools to defend endpoints: design EDR architectures, counter zero-day and insider threats, evade ETW with PowerShell, and hunt malicious domains in DNS logs.

• Coursera
• 8 weeks, 1 hour a week
• Self-Paced
• Paid Course

Antivirus/EDR Evasion & Bypass for Pentesters & Red Teamers

52 ratings at Udemy

Learn to build undetectable Malware which bypasses Antivirus/EDR for Red Teaming, Penetration testing & Ethical Hacking

• Udemy
• 11 hours
• Self-Paced
• Paid Course

DEFCONConference

Defeating EDR Evading Malware with Memory Forensics

Discover advanced memory forensics techniques to detect and analyze EDR-evading malware, including system call manipulation, module overwriting, and debug register abuse.

• YouTube
• 44 minutes
• Self-Paced
• Free Video

Black Hat

The Dark Side of EDR - Repurposing EDR as an Offensive Tool

Explore innovative attack vector transforming EDR into stealthy malware. Learn to bypass security features, exfiltrate data, and establish persistent control, focusing on Palo Alto Networks Cortex XDR.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Black Hat

Veni, No Vidi, No Vici - Attacks on ETW Blind EDR Sensors

A technical examination of how malware can disable Event Tracing for Windows (ETW) and blind endpoint detection and response sensors.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Black Hat

Dirty Vanity - A New Approach to Code Injection & EDR Bypass

Dirty Vanity uses Windows’ built-in forking mechanism for a code injection technique that challenges endpoint detection and response defenses.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

Hack In The Box Security Conference

EDR Evasion Primer for Red Teamers

Explores EDR internals and demonstrates Windows API injection, function unhooking, and custom syscall techniques for evasion.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Conference Talk

BSides SATX

EDR Internals for macOS and Linux - Telemetry Sources and Evasion Techniques

Explore EDR telemetry sources for macOS and Linux, comparing them to Windows equivalents. Gain insights into process monitoring, authentication, networking, and file activity detection techniques.

• YouTube
• 50 minutes
• Self-Paced
• Free Video

DEFCONConference

HookChain: A New Perspective for Bypassing EDR Solutions

Discover a sophisticated EDR bypass technique combining IAT Hooking, dynamic SSN resolution, and indirect system calls to redirect Windows subsystem execution flow while remaining undetected by traditional security measures.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

BSides Budapest IT Security Conference

The Insider Threat: EDR Solutions for Detecting Rogue Personnel

Discover proactive methods for identifying insider threats using EDR solutions, focusing on unique threat hunting techniques to detect potential rogue personnel within organizations.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Red Canary

Validating ATT&CK Technique Coverage Using EDR Telemetry

Master EDR telemetry analysis and validation techniques to effectively detect adversary tradecraft, automate testing workflows, and leverage ATT&CK framework for comprehensive security coverage.

• YouTube
• 52 minutes
• Self-Paced
• Free Video

x33fcon

Unpacking the Unstoppable - How Loaders Continue to Outwit AI, EDR, and Sandboxes

Explore how malware loaders evolve to bypass AI, EDR, and sandboxes, examining their commoditization and advanced evasion techniques in modern cyberattacks.

• YouTube
• 46 minutes
• Self-Paced
• Free Video