Windows Kernel

Implementing KDAMonitor’s fourth sensor: monitoring the creation, modification, and deletion of registry values.

Third KDAMonitor sensor: capturing inbound and outbound IPv4 connections.

Setting up KDAMonitor’s WFP session (provider, sublayer).

Implementing KDAMonitor’s second sensor: monitoring image loads.

Implementing KDAMonitor’s first sensor: monitoring process creation and termination.

Writing logs to disk and the first kernel crash of the KDAMonitor driver.

Building the event queue for the KDAMonitor driver.

Building the KDAMonitor driver foundation: device object and the first IOCTL communication with a test client.

Introduction to the KDAMonitor project and its goals.

Windows kernel driver for malware analysis, logging process, image load, network, and registry activity in real time.