Microsoft's WESP aims to move EDR out of the Windows kernel
Original title: Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Insider builds already include wesp.sys, a mini-filter at altitude 329500, and user-mode API espclient.dll.
Elastic Security Labs examined binaries for Microsoft's Windows Endpoint Security Platform, which is meant to replace per-vendor EDR kernel drivers with one Microsoft-maintained driver. wesp.sys and espclient.dll already ship in a Windows Insider build. The platform is undocumented and early; the analysis says it must cover process, registry, file, and network notifications plus filtering or vendors will keep their own drivers.
Unconfirmed: WESP is undocumented; expected notification coverage and filtering are the author's inference from public symbols, not a Microsoft specification.
- The effort follows the July 19, 2024 CrowdStrike driver crash that hit 8.5 million machines.
- wesp.sys is a file system mini-filter at altitude 329500 and uses a filter communication port.
- EDR user-mode services would connect through espclient.dll.
- Noisy registry and file-read events need filtering inside the driver, the author argues.
- Vendors
- Microsoft
- Organizations
- Elastic Security Labs
From the original article
9 min read at elastic.co
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp. sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.
By Pavel Yosifovich · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.