Stealing Bugs with Valeriy Shevchenko (Ep. 167)
Source: YouTube · Critical Thinking - Bug Bounty Podcast · published Mar 26, 2026 · 51:41
ThreatLocker enforces application controls via three core Windows kernel technologies: minifilter drivers for I/O requests, Windows Filtering Platform (WFP) for network traffic, and EX Version kernel notification routines for real-time process monitoring 0:45.
Key Takeaways:
• Minifilter drivers hook I/O requests to approve or deny file read/write operations based on ACL policies 0:52.
• WFP manages network connection rules at the kernel level, allowing precise control over which processes can communicate on specific ports 0:47.
• EX Version kernel notification routines enable the approval or denial of native API calls, such as process creation, providing robust ring-fencing 0:49.
• These technologies allow administrators to define precise policies that dictate exactly what applications are permitted to do on the network 0:36.
Understanding these mechanisms reveals how ThreatLocker achieves strict security goals through kernel-level enforcement rather than relying on traditional signature-based detection.
Sources:
- 0:45 Introduction to minifilter drivers, WFP, and EX Version kernel notification routines.
- 0:52 Explanation of minifilter drivers hooking I/O requests for file access control.
- 0:47 Role of Windows Filtering Platform in managing kernel-level network traffic rules.
- 0:49 Function of EX Version kernel notification routines in monitoring and approving API calls.
- 0:36 Overview of setting ACLs and policies to restrict applicatio
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
The words were also like, "I did this research." So, like not only was this person stealing your report, but they were also claiming to do research they didn't do? >> That's hilarious. What's the point of hacking when you can just, you know, critical thing, right? All right, y'all. We've talked about ThreatLocker ring-fencing a lot. We know how it allows you to set ACLs and policies for exactly what an application is allowed to do in your network. But today I'm going to tell you how it does that, okay? Three technologies: minifilter drivers, Windows Filtering Platform, and EX Version kernel notification routines. Minifilter drivers are essentially a hook or callback for um IO requests, okay? So, when you're trying to write or read from a file, you can create a hook with those and approve o…