Driver 1 Exploring the Kernel-Mode attack surface: Reverse engineering a vulnerable Driver abused to terminate EDRs Mar 2, 2026