Microsoft is building a way for EDR products to run outside the Windows kernel. It is called the Windows Endpoint Security Platform, and two of its binaries already ship in Windows Insider build. One is the kernel driver wesp.sys, the other the user-mode API espclient.dll.
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
About this summary. This is a short excerpt from the description that Elastic Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.elastic.co/security-labs/blog/windows-endpoint-security-platform-wesp
Source attribution: headline and facts are from Elastic Security Labs (elastic.co). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated. Group-IB researchers…
🏴☠️ Barracuda has just published a new victim : Femern Link Contractors
Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work…
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that…
CVE-2026-69473 Windows Kernel Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-69284 Windows DCOM Server Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-70277 Windows Fast FAT File System Driver Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.