As an engineer working in the integrator business and supporting endpoint security solutions (EPP / EDR / XDR), I still meet many administrators who believe that antivirus alone provides effective protection.
Antivirus solutions are signature-based: to detect a threat you first need a signature, and the AV database must be updated. That model worked well when attacks were simpler, but it has clear limits today. Modern malware often runs purely in memory (fileless), and attackers use legitimate OS tools during an incident (PowerShell, cmd, certutil, etc.) — a class of techniques commonly called “Living Off The Land” (LOTL). Signatures for those techniques are generally not feasible.
Below I compare the behaviour of a traditional AV product (Microsoft Defender) and an EDR/XDR product (Cortex XDR) for exactly the same techniques. The attack vector demonstrated focuses on LSASS — the Windows process that holds credential material — and common offensive tooling that extracts credentials from it (for example, Mimikatz-style techniques). The goal in these scenarios is lateral movement via credentials extracted from LSASS.
Scenario no. 1 — reconnaissance (PowerShell reads LSASS PID)
A PowerShell script looks up the PID of the LSASS process — essentially a reconnaissance step.
Microsoft Defender: no reaction.
Cortex XDR: generated an incident.
Result: Defender did not flag the simple reconnaissance activity, while Cortex XDR correlated the behaviour and raised an incident.
Scenario no. 2 — dump to disk + exfiltration over HTTPS
A PowerShell script creates a dump of LSASS, writes it to disk, and exfiltrates it to an external server via HTTPS.
Microsoft Defender: blocked the malicious script.
Cortex XDR: also blocked the script, but the difference is in visibility. Defender generated a single alert. Cortex XDR grouped related alerts into an incident and provided rich context — technique used, involved host, user account, related processes, timestamps, and so on.
Result: Both products blocked the observable malicious action, but EDR/XDR delivered much more context for investigation and remediation.
Scenario no. 3 — in-memory dump + base64 obfuscation + exfiltration
Obfuscation techniques are applied: the script dumps LSASS entirely in memory (never writes to disk), encodes the payload (Base64), and exfiltrates over HTTPS. Everything happens in memory.
Microsoft Defender: did not detect the activity — the attacker succeeded in stealing credentials.
Cortex XDR: added multiple alerts to the same incident and progressively revealed more details about the chain of events and the full incident.
Result: Signature-based AV was bypassed by a fileless, obfuscated technique. EDR/XDR, with behavioural detection and telemetry correlation, detected and enriched the incident.
Why this matters
Antivirus technology was developed many years ago for a very different threat landscape. Threat actors and their techniques have evolved substantially since then. Signature-only AV cannot reliably detect fileless attacks, living-off-the-land techniques, or many modern obfuscation methods. As the examples above show, even a very capable AV product (Microsoft Defender is a strong AV product) can be bypassed by modern techniques.
Endpoint protection today should be more intelligent: combining machine learning, behavioural analysis, telemetry correlation across endpoints and networks, user behaviour analytics (UBA) and network traffic analysis (NTA). E/XDR solutions provide this broader view and enable detection without requiring a prior signature for a specific threat.
Of course, no solution guarantees 100% effectiveness. But E/XDR systems increase the complexity and cost for attackers — they are more likely to choose easier targets.