Kernel Dll Injector [top] Review

The first time the EDR sees the DLL entry point is when it’s already running inside lsass.exe or your endpoint agent.