Thanks to a recent post from @ericlawrence.com on Defender and Dev Drive, I was reminded of this amazing research series by @n4r1B n4r1b.com/posts/2020/0... I only comprehend ~30% if I'm lucky, but that's a good 10% more than last time I read it 🤣 Still, it's definitely worth reading ;)
n4r1b.comDissecting the Windows Defender Driver - WdFilter (Part 1)In this series of posts I'll be explaining how the Windows Defender main Driver works, in this first post we will look into the initialization and the Process creation notifications among other things
3 reposts13 likes