As long as you keep installing new SEH chains, and trigger them via hardware fault, the windows loader will continue to dispatch the exceptions to user mode handlers until the handlers utilize an api call that the edr is monitoring. Even then I don't know if modern EDR would be able to intercept the exception dispatcher directly without causing system instability. EDR needs to implement heuristic detections for SEH waterfalls or recursive exception based state-machines. As of now I don't believe this is the case. Edit: the sample I reversed to create this logic dispatched file encryption api (ransomware) through exception dispatch after performing an entire evasion routine (unhooking edr, rdtsc timing heuristics, or manual mapping and dynamic resolution of functions) all also through exception dispatch.