EDR bypass