The hope was that the EDR would attempt to delete the ndis.sys file, which due to the junction, is now pointing to the legitimate C:\Windows\system32\drivers\ndis.sys file.

Similar to how EDR is focused on protecting endpoints, NDR uses analytics, machine learning and automation to improve threat detection, containment and incident response processes.