## EDR vs. Legacy Antivirus: The Cage Match

It is important to clearly distinguish between these two technologies, even though marketing often blurs them.

| Feature | Legacy Antivirus (AV) | Endpoint Detection & Response (EDR) |
| :--- | :--- | :--- |
| **Detection Basis** | **Signatures** (Matching known Bad) | **Behavior** (Matching suspicious Actions) |
| **Visibility** | **Black Box**: "I blocked a virus." (End of story) | **Flight Recorder**: "I saw the user open Chrome, download X, run Y..." |
| **Fileless Attacks** | **Blind**: Cannot see in-memory attacks. | **Visible**: Sees memory allocation and script execution. |
| **Response** | **Delete/Quarantine File** | **Isolate Host, Kill Process, Remote Shell** |
| **Analyst Role** | Passive (Wait for alerts) | Active (Hunt and Investigate) |

### The "Next-Gen AV" (NGAV)
Modern tools often combine both. CrowdStrike, SentinelOne, and Defender for Endpoint are actually **EPP (Prevention) + EDR (Detection)** in a single agent.
*   They *do* block known malware (EPP).
*   BUT they also record all activity for investigation (EDR).

### Scenario: The PowerShell Attack
1.  **Attack**: Hacker sends a Word Doc with a macro. The macro runs: `powershell.exe -enc <malicious_code>`.
2.  **Legacy AV**: Scans `winword.exe` (Safe). Scans `powershell.exe` (Safe). **Result**: Infection.
3.  **EDR**:
    *   Sees `winword.exe` spawn `powershell.exe`. (Suspicious).
    *   Sees `powershell.exe` make a network connection to a non-Microsoft IP. (Very Suspicious).
    *   **Alerts**: "Suspicious Process Chain from Word Document."
    *   **Action**: Kills the PowerShell process tree.

### Why "Signatures" are Dead
Attackers use "Polymorphism". They automate their malware compilers to change the code structure every 10 seconds.
*   To AV, it looks like a new file every time.
*   To EDR, it looks like a program trying to encrypt the hard drive (Ransomware behavior). The behavior never changes.