I suppose that's what CrowdStrike's system on Mac uses as well, then. Apparently on Linux they use EBPF and Microsoft is researching that for Windows as well: h

I suppose that's what CrowdStrike's system on Mac uses as well, then. Apparently on Linux they use EBPF and Microsoft is researching that for Windows as well: https://github.com/microsoft/ebpf-for-windows https://github.com/microsoft/ebpf-for-windows . So maybe that's actually the solution they'll go with? It would certainly help solving this particular problem, even if not the kernel-integration in general.