[Skidsuper]

EDR (Endpoint Detection and Response) is a cybersecurity solution that monitors and responds to threats on endpoints, such as computers or devices, in real-time. Does anyone know if there is a way to know if a computer that you are using is being monitored by EDR.

[Charlie Sheen]

Perhaps finding an unknown process in task manager. Monitor network traffic.

[Pimping]

I think you would know if an EDR is running on your pc as there is alerts
also EDRs are made for business/corporations and expensive. usually are not made for normal users

[Riggs]

A lot of EDR agents deployed on user devices are intentionally hidden from user view with tamper protection controls enabled. Depending on if you have local admin to the device, you could try looking in task manager, looking at running processes, or run wireshark and look for any network comms coming to/from to the EDR server to the agent. Maybe also the event viewer security logs.

[Bastille]

Of course :
- check the appwiz.cpl
- check the registry :
> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- check the running processes :
> process hacker
> process monitor (sysinternal)
> process explorer (sysinternal)
- Wireshark / Glasswire / Portmaster (for any network traffic)

[Py_Dev]

use process xp. Check for dll hooks.

[Money-]

It really depends on what type of EDR though. They are many types out there. Some are even just honeypot setups and they have EDR configured to it too to test stuffs and all.

[TheShadowArmy]

EDR (Endpoint Detection and Response) is a cybersecurity solution that monitors and responds to threats on endpoints, such as computers or devices, in real-time. Does anyone know if there is a way to know if a computer that you are using is being monitored by EDR.

I did some research and I found that if you are using Windows or Mac you can check your task manager for processes like:

csagent.exe, falconservice.exe for crowdstrike.

cb.exe, cbcomms.exe for carbon black

SentinelAgent.exe for SentinelOne.

MsSense.exe For MS Defender.

You can also check your network traffic for IP addresses associated with EDR with Win + R "resmon"

Look for the network tab and for the Process and Network Activity section and it should show process names along with their PID and their total network usage, you can then view the TCP Connections under the processes to see the IP, port and process names associated with that process, you should look for processes that I mentioned above by the way.

[kazuma]

EDR really should get buzz word of the year. using wireshark would be the most basic way to try identify anything suspicious happening over the network.

[Skidsuper]

I did some research and I found that if you are using Windows or Mac you can check your task manager for processes like:

csagent.exe, falconservice.exe for crowdstrike.

cb.exe, cbcomms.exe for carbon black

SentinelAgent.exe for SentinelOne.

MsSense.exe For MS Defender.

You can also check your network traffic for IP addresses associated with EDR with Win + R "resmon"

Look for the network tab and for the Process and Network Activity section and it should show process names along with their PID and their total network usage, you can then view the TCP Connections under the processes to see the IP, port and process names associated with that process, you should look for processes that I mentioned above by the way.

Thank you this could be helpful. Are there ways to install video games in the computer without alerting EDR.

[DramaKing]

Thank you this could be helpful. Are there ways to install video games in the computer without alerting EDR.

EDR does not normally trigger alerts if video games are present.

[Skidsuper]

EDR does not normally trigger alerts if video games are present.

Does it not monitor every new software installed?

[DramaKing]

Does it not monitor every new software installed?

I didn't say that EDR doesn't monitor and log software installations, just that it wouldn't generate alerts for legitimate software. Now if you're intending to game on a company computer, you have other things to worry about.

[Lzz00]

EDR does not normally trigger alerts if video games are present.