EDR Mud Fight: Kernel or Userland?

Historical Archive Note: This post was originally published on the Gartner Blog Network on March 18, 2016 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2016/03/18/edr-mud-fight-kernel-or-userland/ | Archive.org Snapshot

I am feeling adventurous, so let’s have an EDR mud fight [pillow fight?] – kernel or userland agent?

	Top Pros	Top Cons
Kernel mode EDR agent	Better resilience vs the attacker Some additional visibility (memory, etc)	Higher chance of system stability problems Some types of visibility not available in kernel mode
User mode EDR agent	Lower chance of stability problems Easier adoption by IT ops	Higher chance of being subverted or avoided by the attacker

As a quick side note, some EDR vendors’ agent code include both kernel and userland components, and while this helps with some cons of the “pure” kernel agent, it does not really mitigate the higher chance of stability problems issue.

To summarize, this is (IMHO) a fight between “Higher chance of system stability problems” vs “Higher chance of being subverted or avoided by the attacker.”

Add your own? Debate? Throw mud or a pillow? 🙂

Blog posts related to our current EDR research:

• Using EDR For Remediation?
• EDR Research Commencing: Call To Action!
• Where Does EDR End and “NG AV” Begin?
• Reality Check on EDR / ETDR
• My Paper on Endpoint Tools Publishes (2013)
• Endpoint Threat Detection & Response Deployment Architecture
• Essential Processes Around Endpoint Threat Detection & Response Tools
• Named: Endpoint Threat Detection & Response
• Endpoint Visibility Tool Use Cases
• On Endpoint Sensing
• RSA 2013 and Endpoint Agent Re-Emergence
• All posts tagged endpoint