Bring Your Own EDR is a technique class in which an attacker repurposes a legitimate endpoint detection and response agent as part of the attack path. Instead of trying to break the operating system directly, the attacker abuses the trust, privileges, or management interfaces of the security tool itself. Because EDR agents are designed to run with broad authority, they can become a privilege carrier into areas that are normally protected.
This matters because modern defenses often assume the security product is harder to abuse than ordinary software. In practice, weak access controls, exposed administrative interfaces, unsafe update paths, or poor anti-tamper settings can let an attacker use the agent to execute unsigned code, modify protected components, or interact with sensitive Windows processes such as PPL services. Defenders should treat EDR administration as high risk: limit local admin access, harden management channels, monitor agent configuration changes, and alert on unexpected child processes or service reconfiguration. The core lesson is that trust boundaries around security tools are attack surfaces too.