> Bar and Cohen first found a byte signature associated with malware on the platform VirusTotal, then inserted it into a database – by doing things like creating a new user with a name that includes the signature.
>
> The EDR program then deemed the database storing the signature to be infected by malware.
>
> If EDR is set to delete infected files, it will do so. The pair argued that databases or virtual machines could therefore be deleted remotely.