netvar1337 Kernel callbacks
Common
- Ps* notify routines
- ObRegisterCallbacks
- Cm callbacks
- Minifilters
Research path
Enumerate → attribute owner module → assess PatchGuard risk → decide remove vs filter vs HV hide
Kernel Callbacks
Windows kernel callback tradecraft: enum/remove/spoof create-process/image/thread/object callbacks, minifilter notes.
Kernel Callbacks by netvar1337 · 380f196
npx skillmds@latest add netvar1337/kernel-callbacks File contents
---name: kernel-callbacksdescription: Windows kernel callback tradecraft: enum/remove/spoof create-process/image/thread/object callbacks, minifilter notes.license: GPL-3.0-or-later---# Kernel callbacks## Common- Ps* notify routines- ObRegisterCallbacks- Cm callbacks- Minifilters## Research pathEnumerate → attribute owner module → assess PatchGuard risk → decide remove vs filter vs HV hide
netvar1337/unleash/tree/main/contrib/skills/kernel-callbacks commit 380f19636c
Frequently asked questions
Run npx skillmds@latest add netvar1337/kernel-callbacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Windows kernel callback tradecraft: enum/remove/spoof create-process/image/thread/object callbacks, minifilter notes. It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free. This skill is licensed under GPL-3.
netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.