EDR Endpoint Containment / Living-off-the-Land Binary Hunt Detects abuse of legitimate system tools, such as Certutil and Rundll32, to identify malicious execution without traditional malware files. · size 20 · threshold 4 · max attempts 3