syscall 1 EDR Series Part 2: Testing the Runtime Assumption - Are Injection APIs The Trigger? Jun 14, 2026