Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Opened
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
Also covered by
- Elastic Security Labs