EDR detection