EDR detection logic is opaque. I built EDR-Introspection, a framework that uses PPL-level access, disables kernel callbacks, and uses reflective DLL injection to execute monitoring code inside the EDR process itself, enabling novel overview of the EDR's logic, thus improving maldev & defence. Endpoint Detection and Response (EDR) solutions are central to modern defence, yet their detection logic remains largely hidden. Red Teamers often rely on trial-and-error bypasses, without deep understanding why certain techniques evade all detection triggers while others fail. EDR Introspection changes this by enabling direct, internal observation of the EDR's actions. The framework leverages kernel-mode capabilities to operate with PPL-level privileges, momentarily disabling of kernel callbacks that would restrict EDR access, and reflectively injects a monitoring DLL into EDR processes. With the monitoring code injected, all relevant system calls from the EDR emit ETW events, like MsMpEng.exe, NtOpenProcess mal.exe, full access, are emitted as ETW events to track them. These events are combined with events from the Antimalware-Engine, Kernel-Proc, -File, -API-Call and -Network traces, as well as the Threat-Intelligence ETW trace, for all-encompassing visibility. The EDR Introspection project effectively enables visibility over static checks of the EDR, emulations and memory scans during runtime. This work enables to observe bypasses live for a first time, from obfuscation, anti-emulation and anti-runtime tracking (deconditioning). Attendees will gain rare insight into how modern EDRs actually function and behave when analysing malware, not just how vendors document them.