Good write-up on building a kernel-based EDR and understanding how Windows telemetry is actually implemented.

Focus is on real detection primitives like:
PsSetCreateProcessNotifyRoutine(Ex) for process lifecycle monitoring

PsSetLoadImageNotifyRoutine for image/DLL tracking

ObRegisterCallbacks for process/thread handle filtering

kernel → user-mode communication via IOCTL + agent design

https://blog.whiteflag.io/blog/from-windows-drivers-to-a-almost-fully-working-edr/