A Windows endpoint begins executing PowerShell commands that download a second-stage payload, spawn a new process, and inject code into a legitimate svchost.exe process. Which EDR capability is MOST critical for detecting this fileless attack chain?

C is correct because the attack uses fileless techniques and process injection into a legitimate process — both bypass file-hash and signature-based detection. Behavioral EDR detects anomalous behavior such as PowerShell as a parent of unusual processes and cross-process memory writes, regardless of file signatures. A is wrong because code injected into svchost.exe has no file to hash. B is wrong because network flow analysis detects the download but not the injection into a legitimate process. D is wrong because the injected payload in memory has no file signature to scan.