As previously mentioned most EDRs have use kernel-level hooks.
This text is from CrowdStrike's patent "Anomaly-based malicious-behavior detection"
In some examples, the kernel-level security agent can operate on computing device 104 as a virtual machine/shadow operating system. The kernel-level security agent loads before the operating system of the host computing device, e.g., very early in the boot-time of the host computing device, by some of the first few dozen instructions in some examples. Pre-boot components of detection module 226 can leverage hardware-provided security features, e.g., firmware signing, although this is not required. By loading early in boot-time, the kernel-level security agent significantly reduces the window in which malware can become active and interfere with operation of the host computing device or run unobserved on the host computing device. In some embodiments, by leveraging hardware-based security features, the agent can also validate the integrity of its computing operations and data and additionally enhance the level of security provided.
In order for an authorized user to bypasses this protection they need a one-time
maintenance-token which is provided by CrowdStrike.
Carbon Black does not have a
maintenance-token. They highly recommend uninstalling or disabling sensors using Carbon Black EDR console.
They do provide a path to uninstall the sensor without using the console. Here is the details on doing this on
Uninstalling Sensors on macOS
To manually uninstall macOS sensors:
On the macOS endpoint where the sensor is installed, run the following command:
After this process is complete, the endpoint stops reporting events and binaries to the Carbon Black EDR server and all the caching information for logs is deleted.