EDR Bypass

EDR bypass is an umbrella term for different methods that can reduce specific endpoint visibility. This record covers three independent examples: restoring user-mode API bytes, invoking system calls outside user-mode hook paths, and reflectively loading code into the current process. They are alternatives, not a required sequence, and none guarantees bypass of all EDR telemetry. Reflective code loading is distinct from remote process injection.