BYOVD - EDR Telemetry Blind Spot Detection (T1562)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•5

Uses time-series anomaly detection to identify a sudden, complete drop-off in DeviceEvents telemetry from a host immediately following a suspect driver load, indicating kernel-mode EDR blinding.