Telemetry
Context
Timeline
Correlation
All of these, when considered together, provide more accurate detection
And that's exactly why AV and EDR Evasion is not just about changing an API
New defense systems try to see the effect and outcome of an operation
Even if the path to that operation has changed
@reverseengine