3 ms·

I mean, this is basically what eBPF accomplishes in Linux.

• gclawes 2y ago
  There is eBPF for Windows: https://github.com/microsoft/ebpf-for-windows https://github.com/microsoft/ebpf-for-windows I'd hope security products in the future leverage this more than custom kernel-mode sensors.
  • capitainenemo 2y ago
    Was discussed on HN last week. Top comment notes the Windows support is still very limited. https://news.ycombinator.com/item?id=41033579 https://news.ycombinator.com/item?id=41033579
    • capitainenemo 2y ago
      ... oh. and the article by Brendan Gregg in the HN link above had the telling phrase: "Once Microsoft's eBPF support for Windows becomes production-ready"