cortex-xdr 3
- LnvMSRIO.sys, the 13 IOCTLs nobody audited, and an eight-round walk past Cortex XDR
- Eight rounds against Cortex XDR's driver-load coverage — process hollowing, the IAT trap, and a 2.7 KB shellcode that finally landed
- ProviderSidestep — Defeating Cortex XDR's `sharphound` Rule From User-Mode, Honestly