research poc
EDR Bypass Using Hardware Breakpoints and NtContinue to Evade ETW TelemetryHardware Breakpoint EDR Bypass via NtContinue
Researchers demonstrated a technique to bypass EDR detection by setting hardware breakpoints via NtContinue, avoiding ETW telemetry. This allows attackers to manipulate execution flow or disable security functions like AMSI without detection. The method highlights a gap in current EDR monitoring of CPU-level debug registers.