Exploring how EDRs detect registry activity, and how modifying registry primitives can bypass ETW and callback-based detection to force deeper defensive change.