EDV - ENDPOINT DETECTION & VIBES

Summary from the TLDR InfoSec newsletter

EDV is a tool that feeds Windows Sysmon security events to Microsoft's Copilot AI through WebSocket connections, asking it to identify malicious activity. Testing with known attack techniques showed Copilot could detect about 40% of malicious events not blocked by Windows Defender, though with inconsistent results and false positives.