Reverse engineering undocumented Windows Kernel features to work with the EDR - 0xflux Red Team Manual | Systems programming

https://fluxsec.red/reverse-engineering-windows-11-kernel