This has analysis of the kernel bug: https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-1/ https://b

This has analysis of the kernel bug: https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-1/ https://breakingmalware.com/documentation/windows-pssetloadi... And this details the workaround: https://breakingmalware.com/documentation/windows-pssetloadimagenotifyroutine-callbacks-good-bad-unclear-part-2/ https://breakingmalware.com/documentation/windows-pssetloadi... What I'd like to know (and lack the ability to figure out for myself) is whether other antivirus products implement the same kind of workaround as Windows Defender, i.e., calling FltGetFileNameInformationUnsafe etc.