Sensecon 23: from Windows drivers to an almost fully working EDR

The article explains how Windows EDRs work and demonstrates building a basic EDR composed of a KMDF driver using kernel callbacks, a user-mode static analyzer, and a remote injector that hooks NtAllocateVirtualMemory via MinHook to detect and block RWX memory allocations tied to CreateRemoteThread-style shellcode injection. It covers AV history, PatchGuard implications, driver development, inter-process communication with named pipes, and shows a working demo that statically flags suspicious binaries and dynamically terminates malicious injection attempts, concluding with a challenge to bypass the sample EDR.