Once an attacker achieves kernel-level code execution on a Windows system, there are essentially no defenses available—they can open back channels to command and control servers or exfiltrate data without detection by standard monitoring solutions