According to NordLayer, there are three primary ways these attacks evade endpoint telemetry:

• Session theft - Attackers can hijack active browser sessions without dropping files or spawning suspicious processes.
• Extension abuse - Malicious or compromised browser extensions can operate with legitimate permissions, making their activity difficult to distinguish from normal behavior.
• User manipulation - Social engineering tactics within the browser can trick users into performing actions that leave little to no forensic trace on the endpoint.

Because these techniques bypass the visibility that EDR provides, browser-level security controls are presented as a way to close the gap and restore detection coverage where endpoint telemetry falls short.

Source: BleepingComputer

Does your organization rely on browser-level controls to catch threats that EDR might miss?