Microsoft’s new WESP driver lacks a way for user-mode EDR to block process creation
The claim
The authors assert that the current preview of wesp.sys does not provide any mechanism for a user-mode client to block process creation.
Published as: “Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform”
So what
If the platform cannot yet block process creation, EDR vendors may need to retain kernel components until Microsoft adds that capability.
The five-minute version
The blog examines the preview binaries of Microsoft’s Windows Endpoint Security Platform, focusing on the kernel driver wesp.sys and its user-mode companion espclient.dll. It shows that wesp.sys is a file-system mini-filter that communicates via a FilterCommunicationPort rather than traditional DeviceIoControl. The analysis finds that the driver lacks any major function handlers and that the user-mode DLL does not expose a reply function, meaning it cannot block process creation. The evidence is based on static binary inspection and live kernel debugging on a VM, without performance or deployment testing.
What they found 1
- wesp.sys has no driver-provided major function handlers, all point to IopInvalidDeviceRequest
“we can see there are no driver-provided major function code handlers (I omitted a few for brevity, but they all point to the kernel-provided handler, IopInvalidDeviceRequest );”
What undercuts it the paper’s own results
- It’s reasonable to assume that not everything will be provided on day one, but I expect everything to be provided eventually.
Stated limits 2
- WESP is not publicly documented.
- Information is based on analysis conducted at the time of writing; subject to change.
What’s new here 4
- Identified wesp.sys as a file-system mini-filter at altitude 329500.
- Discovered that wesp.sys uses FilterCommunicationPort for kernel-user communication.
- Noted the absence of a FilterReplyMessage import in espclient.dll, implying no blocking capability.
- Highlighted Microsoft’s intent to replace third-party EDR kernel drivers with a single, Microsoft-maintained driver.
Artifacts & methods 4
- wesp.syssystem
- espclient.dllsystem
- FilterCommunicationPortprimitive
- fltmc