Security Labs

Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.