Isn't that XProtect?

Fixing one’s kernel extensions does not violate anticompetitive laws. It does however make for click bait headlines if you as a corp choose to troll everyone affected by CrowdStrike instead of offering mitigations.

I think people don't know that Microsoft also has a Crowdstrike Falcon competitor that isn't too bad at all. While it would be funny to call out the hypocrisy in the tech world, I think the DoJ would indeed sue Microsoft unless it extracted it's own EDR and had it use the same API's it is asking other companies to use. Furthermore, there is something called the anti-malware scanner interface (AMSI) which Falcon and other EDRs indeed use and there is an ETW api that allows them to do additional monitoring as well. But that just isn't enough to counter many real world threats. In effect, the EDR must be like a rootkit to get complete system visibility and be able to stop any and all threats, kernel or userspace. Also, a user space process can prevent booting or freeze systems up.

You are responding to a statement from Microsoft that compares its own behavior to that of Apple. Why do you characterize it as everyone else thinking Microsoft should be more like Apple?

Which one? Defender isn't a CS competitor.

I _think_ at least, the enterprise software space is confusing as hell :)