All EDR software does (at least on macos) Source: me, a developer who also codes in free time and notices how bad fs perf is especially. I've had the CrowdStr

All EDR software does (at least on macos) Source: me, a developer who also codes in free time and notices how bad fs perf is especially. I've had the CrowdStrike sensor, and my current company is using cyberhaven. So.. while 2 data points don't technically make a pattern, it does begin to raise suspicion.