As cited
Copy frozen at (site build).
cloud saas
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft is building the Windows Endpoint Security Platform (WESP) to move endpoint detection and response (EDR) products from kernel mode to user mode, following the July 2024 CrowdStrike outage that crashed 8.5 million machines. The framework centers on a Microsoft-maintained kernel driver, wesp.sys, that communicates with user-mode EDR services through filter communication ports, replacing the current model where each security vendor ships its own kernel driver. Analysis of the undocumented binaries reveals wesp.sys operates as a file system mini-filter at altitude 329500, with the espclient.dll user-mode application programming interface (API) providing functions for rules, filters, and event notification, though current symbols suggest blocking capabilities may not yet be fully implemented.
Why it matters: EDR vendors and Microsoft must evaluate adoption of WESP to reduce kernel-level crashes that disable systems enterprise-wide, while security teams need to understand how this architectural shift affects product capabilities, migration timelines, and monitoring effectiveness.
- Source published
- First seen by Cybersecurity Tracker