With the introduction of Kernel Patch Protection, Microsoft created a shared responsibility model where security vendors are now limited to only the kernel visibility and extension points that Microsoft provides. This means that Microsoft is responsible for a) providing the necessary kernel telemetry, and b) servicing bugs in existing kernel telemetry.

So I wrote some Windows telemetry unit tests.

This talk will cover various bugs and other code smells in the security-relevant telemetry generated by Windows.