--- title: Windows Endpoint Security Platform: Inside wesp.sys description: Microsoft is building the Windows Endpoint Security Platform (WESP) to move EDR software out of the kernel, after a July 2024 CrowdStrike update crashed 8.5... canonical: https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Windows Endpoint Security Platform: Inside wesp.sys | daily.dev og:description: Microsoft is building the Windows Endpoint Security Platform (WESP) to move EDR software out of the kernel, after a July 2024 CrowdStrike update crashed 8.5... og:url: https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg og:image: https://api.daily.dev/og/posts/T3ln5XXhg.png og:image:alt: Windows Endpoint Security Platform: Inside wesp.sys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows Endpoint Security Platform: Inside wesp.sys **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 11 min read · 0 upvotes · 0 comments ## Summary Microsoft is building the Windows Endpoint Security Platform (WESP) to move EDR software out of the kernel, after a July 2024 CrowdStrike update crashed 8.5 million machines. Two preview binaries already ship in Windows Insider builds: the kernel driver wesp.sys and the user-mode API espclient.dll. A kernel debugging session shows wesp.sys is a file system mini-filter at altitude 329500 that talks to user mode over a filter communication port, with no device objects and no classic DeviceIoControl support. The client DLL imports FilterConnectCommunicationPort and FilterGetMessage but not FilterReplyMessage, suggesting user mode currently cannot reply to the driver to block a process from being created. Elastic says it is preparing Elastic Defend to support WESP. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Windows Endpoint Security Platform (WESP) and why is Microsoft building it? WESP is Microsoft's framework for moving endpoint detection and response (EDR) functionality out of the Windows kernel into user mode. It centers on a kernel driver, wesp.sys, built and maintained by Microsoft itself, plus a user-mode API, espclient.dll, that EDR vendors use to receive notifications. Microsoft pursued this after a July 2024 CrowdStrike kernel driver update crashed 8.5 million machines worldwide. _Vendors evaluating kernel-driver risk can follow WESP's rollout details on daily.dev as EDR architecture shifts._ ### Can a WESP user-mode client currently block a process from being created? Not yet, based on preview binaries. espclient.dll imports FilterConnectCommunicationPort, FilterGetMessage, and FilterSendMessage from FltLib.dll but is missing FilterReplyMessage, the function needed to reply to the kernel driver with a block decision. That absence implies the current communication is one-way, so user mode can observe process creation but cannot veto it like a kernel driver using PsSetCreateProcessNotifyRoutineEx can. _Security engineers tracking WESP's blocking capability can watch for updates on daily.dev before migrating EDR logic._ ### What kind of Windows driver is wesp.sys and how does it communicate with user mode? wesp.sys is a file system mini-filter registered with the Filter Manager (FltMgr.sys) at altitude 329500, confirmed via the fltmc command-line tool. It has no device objects, so it cannot use classic DeviceIoControl; instead it communicates with user-mode clients through a FilterCommunicationPort kernel object named ESPFilterPort, created with FltCreateCommunicationPort. _Developers debugging kernel drivers can keep up with mini-filter internals like this on daily.dev._ ## Similar posts on daily.dev - [SprySOCKS Windows Variant Uses Kernel Drivers to Evade Detection](https://daily.dev/posts/sprysocks-windows-variant-uses-kernel-drivers-to-evade-detection-vyz246iry) · Dark Reading · 0 upvotes · 0 comments - [Researcher creates workaround for Microsoft Defender security patch](https://daily.dev/posts/researcher-creates-workaround-for-microsoft-defender-security-patch-30gt7sysk) · CSO Online · 0 upvotes · 0 comments - [How the GodDamn Ransomware Driver Bypasses Your EDR](https://daily.dev/posts/how-the-goddamn-ransomware-driver-bypasses-your-edr-6ruyzz7fu) · Latest Hacking News · 0 upvotes · 0 comments - [Microsoft releases Windows 10 KB5082200 extended security update](https://daily.dev/posts/microsoft-releases-windows-10-kb5082200-extended-security-update-6cyidq4j8) · BleepingComputer · 1 upvotes · 1 comments --- [View this post on daily.dev](https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Windows Endpoint Security Platform: Inside wesp.sys","url":"https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg"},"datePublished":"2026-10-26T17:31:29.183Z","dateModified":"2026-10-28T21:35:37.621Z","description":"Microsoft is building the Windows Endpoint Security Platform (WESP) to move EDR software out of the kernel, after a July 2024 CrowdStrike update crashed 8.5...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a8d4665c87cd0fd5e2c7ca19b667a452?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a8d4665c87cd0fd5e2c7ca19b667a452?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"Windows Endpoint Security Platform: Inside wesp.sys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/windows-endpoint-security-platform-inside-wesp-sys-t3ln5xxhg#faq","mainEntity":[{"@type":"Question","name":"What is the Windows Endpoint Security Platform (WESP) and why is Microsoft building it?","acceptedAnswer":{"@type":"Answer","text":"WESP is Microsoft's framework for moving endpoint detection and response (EDR) functionality out of the Windows kernel into user mode. It centers on a kernel driver, wesp.sys, built and maintained by Microsoft itself, plus a user-mode API, espclient.dll, that EDR vendors use to receive notifications. Microsoft pursued this after a July 2024 CrowdStrike kernel driver update crashed 8.5 million machines worldwide. Vendors evaluating kernel-driver risk can follow WESP's rollout details on daily.dev as EDR architecture shifts."}},{"@type":"Question","name":"Can a WESP user-mode client currently block a process from being created?","acceptedAnswer":{"@type":"Answer","text":"Not yet, based on preview binaries. espclient.dll imports FilterConnectCommunicationPort, FilterGetMessage, and FilterSendMessage from FltLib.dll but is missing FilterReplyMessage, the function needed to reply to the kernel driver with a block decision. That absence implies the current communication is one-way, so user mode can observe process creation but cannot veto it like a kernel driver using PsSetCreateProcessNotifyRoutineEx can. Security engineers tracking WESP's blocking capability can watch for updates on daily.dev before migrating EDR logic."}},{"@type":"Question","name":"What kind of Windows driver is wesp.sys and how does it communicate with user mode?","acceptedAnswer":{"@type":"Answer","text":"wesp.sys is a file system mini-filter registered with the Filter Manager (FltMgr.sys) at altitude 329500, confirmed via the fltmc command-line tool. It has no device objects, so it cannot use classic DeviceIoControl; instead it communicates with user-mode clients through a FilterCommunicationPort kernel object named ESPFilterPort, created with FltCreateCommunicationPort. Developers debugging kernel drivers can keep up with mini-filter internals like this on daily.dev."}}]} ```