EDR 2 Windows Persistence (Part 1): Default file extension hijacking Mar 9, 2026 Exploring the Kernel-Mode attack surface: Reverse engineering a vulnerable Driver abused to terminate EDRs Mar 2, 2026