Vendor marketing says "next-generation AI." The engineering reality is less mystical and more useful to understand: a modern EDR is layered telemetry plus a correlation engine. Every implant decision we make at AXIS starts from this map, and this note is the map — at the level of categories, the way we brief customers. Knowing the terrain beats collecting tricks.
Layer one: user-mode hooks
The classic layer. The EDR injects its own library into new processes and patches the entry points of the native API — before your call reaches the kernel, the agent has already read its arguments. This is the layer that sees "who asked to allocate executable memory" with the full call stack attached. It is also the layer with the most public counter-literature: unhooking, direct syscalls, and their many descendants. All of that counters exactly one layer of five.
Its structural weakness is reach. The hooking library only sees processes it is injected into: processes started before the sensor, processes that block foreign module loads, and anything the injection logic decided to skip. Protected processes — and the protected-light tier most security products now run as — are outside this layer entirely.
Layer two: kernel callbacks
The EDR's driver registers for the operating system's own notification channels: process and thread creation, image loads, registry operations, object-handle requests. This is the layer that can strip rights from a handle before your process ever receives it — which is why opening a full-access handle to a monitored process quietly returns less than you asked for, with no error. Minifilter drivers add the file system view; early-launch drivers put the sensor ahead of almost everything else at boot.
The weakness here is timing and volume. Notifications are delivered after creation, not before — a fast enough actor wins small races. And every callback costs the vendor CPU in every customer machine on earth, so vendors tune aggressively: high-frequency events get sampled, and sampled telemetry is, by definition, partial.
Layer three: ETW
Event Tracing for Windows is the operating system narrating itself: thread and memory events, image loads, .NET assembly compilation, script execution, network flows. Security products consume the threat-intelligence provider and friends to see behaviors that never touch a hooked API. This is the layer that made "we never call the native API directly" stop being a plan.
Its weakness is that the narration is produced in-process and consumed out-of-process. A process can interfere with its own ETW session — but blinding a provider is itself a loud, well-catalogued behavior. The honest way to read ETW is not "can it be disabled" but "what does attempting to disable it tell the correlation engine."
Layer four: AMSI
The Antimalware Scan Interface routes script and macro content — PowerShell, Office automation, JavaScript hosts, .NET's in-memory assembly loads — through the security provider at execution time, from inside the host process. Anything that lives in a scripting surface passes this layer. Its boundary is equally clear: content that never enters a scripting host never meets AMSI. It is a checkpoint on specific roads, not a wall around the country.
Layer five: the wire and the sandbox
Outside the endpoint entirely: DNS patterns, TLS metadata, session periodicity, and detonation of suspicious binaries in instrumented environments. Network-layer detection cannot be unhooked by anything you do on the host — which is why we treat the traffic profile as a first-class design decision rather than an afterthought, and why every AXIS build is exercised against current sensor builds as part of release QA.
The product is the correlation engine
Single events are noise. The sequence is the signal.
Here is the part that matters most, and the part bypass folklore ignores. A memory allocation means nothing; an allocation, a thread start into it, an unsigned image load in the parent, and a new TLS session ninety seconds later means everything. The vendor's real product is the engine that joins events across all five layers — per host, per user, per fleet — and scores the sequence. This is also why "I patched the hooks" does not equal invisible: you have convinced one witness out of five, and the other four now testify about a process that the first witness mysteriously stopped describing.
{"ts":"14:31:02.114", "ev":"process.create", "pid":5104, "img":"svchost.exe", "parent":"services.exe"}
{"ts":"14:31:04.772", "ev":"mem.alloc", "pid":5104, "size":"64 KB", "prot":"RWX", "src":"unbacked"}
{"ts":"14:31:04.815", "ev":"thread.start", "pid":5104, "entry":"unbacked+0x1a20"}
{"ts":"14:32:33.090", "ev":"net.tls", "pid":5104, "sni":"cdn-metrics.example"}
# any single line above: noise. the sequence: score 0.97 → alert
What we take from the map
Doctrine, not recipes — those stay in the licensed material. Durable implants blend into sequences, not single calls: behave like software that belongs on the machine, at a pace the machine finds normal, over channels the profile can honestly explain. Every evasion technique is a signal with a half-life; the techniques that age well are the ones that remove the need for a signal in the first place. When the engagement genuinely requires the loud options — kernel-level work, driver abuse — the correct mental model is "buying time against the correlation engine," and the budget is always smaller than the folklore suggests.
What defenders should take from it
Hunt sequences, not artifacts. Turn on the telemetry that costs money — threat-intel ETW, script-block logging, driver-load auditing — because the layers an implant cannot reach are your cheapest advantage. Treat tamper events as crown-jewel alerts: an EDR that suddenly sees less is itself the detection. And measure your coverage against the five layers, not against the marketing diagram; any layer you cannot enumerate is a layer an implant already has.