edr scanning

The edr scanning tag covers discussions about endpoint detection and response (EDR) tools and their limitations when scanning Windows file systems, particularly regarding NTFS junctions and path redirection. A key thread highlights that EDR recursive scanning should not be trusted alone against threats like GhostTree, which exploit junction following without cycle detection or privilege awareness. The content emphasizes patching Windows, enabling Microsoft's junction mitigations, and not relying solely on EDR scanning as a control. Practical advice includes updating both Windows and endpoint tools, and removing blind trust from recursive directory enumeration. The tag focuses on security, Windows features, and the need for layered defenses beyond EDR scanning.