EDR tampering