My heart goes out to AV/EDR developper because i really don't see how it is possible to analyze most of the code being run somewhere in realtime, without a significant toll on the machine...