Dissecting the Windows Defender driver

For the next couple (or maybe more) posts I'll be explaining how WdFilter works. I've always been very interested on how AVs work (Nowadays I would say EDRs though) and their development at kernel level. And since, unfortunately I don't have access to the source code of any, my only chance is to reverse them (or to write my own). And of course what a better product to check than the one written by the company who developed the OS.

For those who don't know, WdFilter is the main kernel component of Windows Defender. Roughly, this Driver works as a Minifilter from the load order group "FSFilter Anti-Virus", this means that is attached to the File System stack (Actually, quite high - Big Altitude) and handles I/O operations in some Pre/Post callbacks. Not only that, this driver also implements other techniques to get information of what's going on in the system. The goal of this series of post is to have a solid understanding on how this works under the hood.

Not for the fain of heart.