Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

Microsoft is building a way for EDR products to run outside the Windows kernel. It is called the Windows Endpoint Security Platform, and two of its binaries already ship in Windows Insider build. One is the kernel driver wesp.sys, the other the user-mode API espclient.dll. Microsoft wants one kernel driver it maintains itself, in place of the one... Weiterlesen: Kernel eviction notice: What wesp.sys reveals about the Windows Endpo…