Paraphrasing the Windows Kernel team: Improving security-relevant kernel telemetry is not a priority for us.

There appears to be a disconnect between Microsoft’s public messaging on security and how it is incentivising its workforce.

Personally I’d love to see a new process security mitigation that blocks the creation of unnamed (aka non-exported) threads. Same for APCs.

Possibly coupled with a new default compiler behaviour that identifies thread entrypoints and adds them to the export table.

Easier to change 10 compilers than 10000 apps…

Wouldn’t using the public symbol of the thread’s entrypoint cover the most common cases?

Variations of this pop up every few years. Mostly to avoid compound behavioural rules.

theevilbit.github.io/posts/divide...

Kernel bug details emailed.

Has this episode been published yet?

The Airlock Digital interviews are the best. 😃

Though software bugs are BAU.
So I’m more interested in who thought it was a good idea to deploy IT EDR on business critical OT systems.

Was this pushed by overly aggressive sales? Or did the CISOs not understand risk?

You should clarify that it was caused by a bug in their kernel driver that was triggered when they forcibly globally deployed a bad content update with buggy unit testing and no integration testing.

This is absolute 🔥- and will significantly harden the path to domain admin against common initial access vectors.

Is it looking likely to be the default for existing installs after upgrade, or just for new installs?

When are you speaking at AISA PerthSEC though?

www.bsidesau.com.au