Windows Behavior Monitor
User-mode endpoint monitoring for Windows
A company-assigned research project during my internship at CMC Cyber Security. Contributed the Process & Memory Monitoring (PMM) module to a team-built endpoint monitoring prototype.
- Enumerated processes and tracked PID + creation time to account for PID reuse.
- Inspected process memory with Windows APIs to flag private RWX regions as potential injection indicators.