// Comparison

The Art of Mac Malware, Volume 2 vs Evading EDR: Which Should You Read?

Two cybersecurity books on Malware, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52025

Detecting Malicious Software

Patrick Wardle

The detection-focused sequel to Volume 1, Wardle turns from analyzing Mac malware to building the heuristics and tooling that catch it, using macOS's security frameworks and real-world malware samples throughout.

Advanced

4/52024

Evading EDR

The Definitive Guide to Defeating Endpoint Detection Systems

Matt Hand

A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.

Read this if

Detection engineers and blue teamers who already have Volume 1's analysis grounding and now need to build detections, not just read samples. Shows how to program against macOS's own security-centric frameworks (Endpoint Security, ESF) rather than relying only on third-party AV.

Red teamers and detection engineers who want to reason about EDR from the sensor up rather than copy-pasting the bypass of the week.

Skip this if

Readers who haven't worked through Volume 1's foundations first (Mach-O, code signing, persistence taxonomy); this book assumes that vocabulary and builds detection logic on top of it rather than re-teaching it.

Anyone wanting a turnkey list of working bypasses. Skip this if you don't run Windows or won't sit through the internals.

Key takeaways

Detection, not just analysis, is the book's whole focus — moving from "what is this sample doing" to "how do I catch the next one like it."
Builds heuristics directly on top of macOS's own security frameworks (Endpoint Security) instead of treating the OS as a black box.
Every technique is grounded in real malware families Wardle has tracked through Objective-See, not synthetic examples.

EDR is a collection of telemetry sources, not a monolith; evasion means knowing which source sees what.
Most durable bypasses attack the sensor's data collection, not its detection logic.
Vendor-agnostic understanding outlives any specific bypass, which vendors patch fast.

How they compare

The Art of Mac Malware, Volume 2 and Evading EDR are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

The Art of Mac Malware, Volume 2 and Evading EDR both cover Malware, Detection, so reading them in sequence reinforces the same material from different angles.

Keep reading

The Art of Mac Malware, Volume 2

→ Alternatives to The Art of Mac Malware, Volume 2 → What to read after The Art of Mac Malware, Volume 2