Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
- Vendor
- Microsoft
- Product
- Windows
- Exposure class
- Operating system
Why it ranks 17 (Routine)
- Product class: operating system
- Widely deployed vendor product (Microsoft)
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Elastic Security Labs (elastic.co)