Anatomy of a WHQL-Signed Windows Filtering Platform (WFP) Kernel-Resident Network Backdoor

This report documents a malicious, WHQL-signed 64-bit Windows kernel driver (`wskmon.sys`) that implements a full-featured remote backdoor via a WFP stream callout, accepting encrypted, HMAC-SHA256-authenticated commands over the network and executing them entirely in kernel mode; it includes build and signing metadata, SHA-256, and detection/reverse-engineering findings.