Purple Edge
Get started

Evasion and EDR Bypass

advanced3 labsSubscription

Understand endpoint evasion in order to defeat it: how EDR sees, the families of evasion and their detection, and a catch-what-evaded capstone that ends in a resilient detection.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    advanced Hands-on lab Subscription

    How EDR Works

    The telemetry sources and hooks a modern endpoint detection product uses to see what runs on a host.

    45 min3 tasksdetection-engineering
  2. 2
    advanced Hands-on lab Subscription

    Evasion Techniques and Their Detection

    The families of evasion that blind endpoint sensors, and the telemetry that still catches each.

    55 min3 tasksdetection-engineering
  3. 3
    advanced Hands-on lab Subscription

    Capstone: Catch What Evaded the EDR

    An intrusion slipped past the endpoint product. Reconstruct it from the telemetry the evasion did not blind, and harden the detection.

    90 min3 tasksdetection-engineering

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-09-01