RedEdr DLL hooking finally works reliable. Just have to filter out all events of the hooking, and more importantly, SymInitialize() telemetry itself.
Why? Analyzer doing Detections on it generated a lot of false positives, which made it unusable.
about 1 year ago