Tyler Burns on Nostr: A lot are still usermode hooks. Some are mixed. For example, CarbonBlack has some ...
A lot are still usermode hooks. Some are mixed. For example, CarbonBlack has some kernel level drivers for file and network detections, but its prevention policies all operate as usermode hooks.