Windows Internals and EDR Development: Visibility, Bypasses and Defenses

Summary

Pavel Yosifovich and Josh Stroschein discuss Windows EDR architecture, direct-syscall blind spots, ETW threat-intelligence events and the trade-offs between endpoint visibility, performance and stability.

Key points

Yosifovich explains how EDR kernel drivers communicate with user-mode services and use kernel callbacks to observe events such as process and thread creation.
Direct system calls can bypass user-mode API hooks, while limited kernel callbacks and the cost of memory scanning constrain visibility.
The Windows threat-intelligence ETW provider can report cross-process memory operations and queued APCs, but its events do not themselves block activity.
Yosifovich demonstrates that an administrator cannot start a threat-intelligence provider session with his ETW Studio tool and explains the provider's restricted access.
The speakers discuss the stability risks of kernel drivers and uncertainty about how moving security functionality to user mode would affect timely detection.
Yosifovich suggests application-control rules and security education as complementary defenses, while describing hardware-based security and memory-safe languages as possible future directions.

Article Details

Topics: [04:27] EDR architecture and kernel-to-user-mode communication
[08:20] Kernel callbacks, direct system calls and memory-scanning limitations
[12:14] Kernel driver stability and proposed user-mode security changes
[17:48] PatchGuard and Hyperguard protections
[20:45] EDR self-protection and resource constraints
[24:23] Threat-intelligence ETW events and detection limitations
[27:27] ETW Studio demonstration and provider access restrictions
[34:56] Direct-syscall detection and static analysis
[37:40] Security education and application-control rules
[44:08] Potential hardware and memory-safe language approaches to endpoint security