August 15, 2024

Content updates and product architecture: Sophos Endpoint

Sophos X-Ops takes a look at the content updates in Intercept X, and how we validate and release them

Threat Research

August 01, 2024

Driving lessons: The kernel drivers in Sophos Intercept X Advanced

Operating in kernel-space is necessary, but risky – here’s how we do it in Sophos Intercept X Advanced

Threat Research

April 10, 2024

A tumultuous, titanic Patch Tuesday as Microsoft makes some changes

The largest CVE count in recent history rolls out

Threat Research

March 04, 2024

It’ll be back: Attackers still abusing Terminator tool and variants

First released in May 2023, an EDR killer – and the vulnerable Zemana drivers it leverages – are still of interest to threat actors, along with variants and ported versions

Threat Research

January 25, 2024

Multiple vulnerabilities discovered in widely used security driver

A false-alarm incident involving Panda Security software leads to three very real CVEs

Threat Research

July 11, 2023

Microsoft Revokes Malicious Drivers in Patch Tuesday Culling

Threat Research

December 13, 2022

2022 Patch Tuesday cycle wraps with 48 CVEs, one advisory

Windows-heavy collection closes out a year of elevation-of-privilege vulnerabilities

Threat Research

December 13, 2022

Signed driver malware moves up the software trust chain

The criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificate

Security OperationsThreat Research