Protobuf Hacking, AI-Powered Bug Hunting, and Self-Improving Claude Workflows (Ep. 165)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Mar 12, 2026 · 44:36
BLUF: This video details ThreatLocker’s ring-fencing architecture, explaining how it uses Mini Filter Drivers, Windows Filtering Platform (WFP), and EX version kernel notification routines to enforce strict application policies 0:33.
Key Takeaways:
• Mini Filter Drivers act as hooks for I/O requests, allowing ThreatLocker to approve or deny file read/write operations based on ACLs 0:52.
• Windows Filtering Platform controls network traffic by intercepting connect/bind requests to enforce policies on which processes can communicate on the network 0:45.
• EX version kernel notification routines detect process creation events, enabling the system to apply policies exactly when an application starts 0:47.
• The speaker shares his experience presenting at Zero Trust World, highlighting the success of using Claude Code to generate slides and labs from Markdown outlines 1:15.
ThreatLocker’s layered approach ensures applications only perform authorized actions, while the speaker demonstrates how AI tools are revolutionizing technical presentations and bug bounty workflows.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Claude can also do the hosting now. Like you can literally just say like host it, you know, and then it will go do that. You know, I did that with the zero trust world thing. >> Best possible Viking when you can just, you know, critical thing. >> [music] [laughter] >> All right, y'all. We've talked about ThreatLocker ring-fencing a lot. We know how it allows you to set ACLs and policies for exactly when an application is allowed to do in your network. But today I'm going to tell you how it does that, okay? Three technologies: mini filter drivers, Windows filtering platform, and EX version kernel notification routines. Mini filter drivers are essentially a co- hook or callback for um IO requests, okay? So when you're trying to write or read from a file. You can create a hook with those and …