Endpoint Detection and Response software operates with root system permissions to monitor device behavior and block malware execution