The significant thing here is that the technique should interfere with data collected by all common EDR software, rather than requiring specific tailoring for each one like most EDR bypass tricks. I’m curious about why the API protections present in Windows 11 couldn’t be brought to Windows 10.

>Multiple pieces of evidence show that Microsoft is aware of the weakness, but is not changing the API behavior retroactively on Windows 10, likely due to retro-compatibility issues.

If MS actually says that, it seems like a lame excuse.