# Kernel Callbacks

> Windows kernel callback tradecraft: enum/remove/spoof create-process/image/thread/object callbacks, minifilter notes.

- Skill: `netvar1337/kernel-callbacks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/kernel-callbacks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/kernel-callbacks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/kernel-callbacks

---


# Kernel callbacks

## Common
- Ps* notify routines
- ObRegisterCallbacks
- Cm callbacks
- Minifilters

## Research path
Enumerate → attribute owner module → assess PatchGuard risk → decide remove vs filter vs HV hide