I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its behavioral analysis/zero day detection/insert marketing term here.
So I can figure out how to better operate against such systems as an attacker trying to evade them would. Obviously there is a great deal of secrecy in terms of the nitty gritty details of how such systems determine a certain pattern of behavior is suspicious, both to prevent other vendors from copying techniques and to make it harder for actual attackers to figure out how to evade them.
Is there any general overview of what most EDR/XDR solutions consider "suspicious?" I understand the obvious patterns -- for example, an unknown process opening a handle to explorer.exe / chrome.exe, a process overwriting executable files, processes running out of weird directories, potentially in particularly locked down systems any unsigned image being run at all, etc. And I suppose as I practice at it over time I will figure out more through trial and error. But is there any resource to provide information on what kind of things these solutions are looking for besides that?
I figure if I want to be effective at redteaming I'd want to act as an attacker actually would so I can provide a realistic assessment of how well the blue team's security works, and running around setting off the EDR/XDR blatantly obvious attacks then just saying "yup looks like your security is good" because their security solution managed to detect a Metasploit module calling
WriteProcessMemory against Explorer isn't the most effective way to actually assess someone's security against an actually competent attacker.
Obviously security vendors aren't going to just give out point by point explainers on how their software works specifically under the hood, but I figured it would be good to understand how it works as much as possible to more accurately assess its effectiveness.