> run EDR > does not detect initial compromise > does not detect persistent so > does not detect preloads > does not detect injection > does not detect exf

> run EDR > does not detect initial compromise > does not detect persistent so > does not detect preloads > does not detect injection > does not detect exfiltration What does the D stand for again? Besides the entire threat vector and article being an unsurprising non-story. Yes, if you can modify the execution environment you can modify the executed code.