Hacker News Reader

I mean, this is basically what eBPF accomplishes in Linux.

There is eBPF for Windows: https://github.com/microsoft/ebpf-for-windows

I'd hope security products in the future leverage this more than custom kernel-mode sensors.

Was discussed on HN last week. Top comment notes the Windows support is still very limited. https://news.ycombinator.com/item?id=41033579

... oh. and the article by Brendan Gregg in the HN link above had the telling phrase: "Once Microsoft's eBPF support for Windows becomes production-ready"

Reply on news.ycombinator.com