Which process did this? Which thread did it? Which memory region was used? What was the call stack like? When did this happen? What happened before and after? This is exactly one of the important differences between Signature Detection and Behavioral Detection. Signature Detection is more about looking for a specific pattern. For example: This Hash This String This Pattern This Signature While Behavioral Detection is more about looking for the relationship between events. That is, this Process This Thread This Memory This Stack and this Behavior Do they create an unusual pattern when put together? This is also very important from the Red Team's perspective. Suppose you change a specific Event to be less visible. You might think, "Well, that's it." But no, because EDR may not just look at the Event itself. It may look at the relationship between several different layers. For example:

Process +
Memory +
Thread +
Call Stack +
Network +
Timing ↓
Behavior Pattern

That is, even if a particular event is less visible
The relationship between other events may still create a certain pattern
So when you study EDR Evasion
Don't just memorize the names of the techniques
For example, you don't know what a particular technique is
It is more important to understand
Which Visibility Layer exactly does this technique affect
For example, you should be able to ask yourself

Where does EDR see this from
From Process
From Thread
From Memory
From API
From Call Stack
From Kernel
From Network
Or a combination of several
In this way, you gradually move away from memorizing techniques
And you start to understand what the security system really sees
Now let's put the whole discussion of this post together

API
↓
Call Stack
↓
Thread
↓
Memory
↓
Process
↓
Network
↓
Behavior


The more Context we have of an Event, the more accurate the behavior analysis can be, so an API alone may not give us much information
But when we say
This API is used by this Thread
Inside this Process
From this Memory Region
With this Call Stack
At this Time
And with this Network Activity
Now we have a much more complete picture
And this is exactly what makes Behavioral Detection Analysis so much more interesting than just looking at a simple Signature

The Call Stack
is not just a simple list of Functions
But a clue to the path that Execution took to get to the current point
So when a critical operation happens

Don't just ask
What was executed
Ask a more important question
Where did it get here
And when you put this question aside from Process and Thread and Memory and Network
You are starting to get closer to the view that modern EDRs use for behavior analysis

@reverseengine