Skip to content

Back to the catalog

Cross-Platform Unity in EDR
huntress.comarticle

Cross-Platform Unity in EDR

Huntress's Principal EDR Product Researchers explain how their Managed EDR collects telemetry differently on Windows (kernel callbacks, ETW, Event Log, AutoRuns point-in-time surveys), macOS (Apple's Endpoint Security API, TCC/Gatekeeper constraints, code-signing enrichment), and Linux (eBPF hooks, file-activity-as-persistence-proxy), and why full feature parity isn't always pursued. It also details their Ransomware Canaries capability (260+ confirmed-ransomware alerts in 2025 on Windows) and why canaries aren't yet prioritized on macOS/Linux given the current threat landscape (citing Akira SMB-based remote ransomware, EvilQuest/ThiefQuest VirusTotal sample inflation, and a non-viable 2023 macOS LockBit variant noted by Objective-See's Patrick Wardle).

TL;DR Huntress EDR researchers detail their per-OS telemetry architecture (kernel callbacks/ETW on Windows, Endpoint Security API on macOS, eBPF on Linux) and why they don't chase feature parity for capabilities like Ransomware Canaries across platforms.
Open original ↗

Organisations named here

  • Objective-See
  • ThiefQuest

Technologies named here

  • Huntress Managed EDR
  • Windows
  • Ransomware Canaries
  • macOS
  • AutoRuns
  • Linux
  • Apple Endpoint Security API
  • Linux-like ESXi hosts
  • eBPF
  • ETW
  • Kernel callbacks
  • VirusTotal
  • SELinux
  • AppArmor
  • Transparency, Consent, & Control
  • Gatekeeper
  • BTM
  • EDR

Techniques named here

  • SMB-based remote ransomware
  • Real-time telemetry collection
  • Point-in-time collection
  • eBPF kernel hooking
  • File activity monitoring as persistence proxy
  • Code signing / Developer ID inspection
  • Process tree/lineage analysis
  • Ransomware canary file monitoring
  • Persistence mechanism monitoring

Threat actors named here

  • Akira
  • EvilQuest
  • LockBit

Also named here

  • Patrick Wardle

Related in Blue Team & Detection