Notes from building NewGen-AV: Windows internals, endpoint telemetry, static analysis, offensive testing, and the edge cases that make the project sharper.
Latest posts
4 posts - updated Jul 07, 2026
From File Scan to Process Kill
How NewGen-AV resolves ETW file paths, loads executable content, asks AMSI for a verdict, maps the result internally, and terminates malicious processes.
From Windows Telemetry to Normalized Events
How NewGen-AV creates a real-time ETW session, consumes Kernel Process events, normalizes process and image-load telemetry, and hands events to the engine.
Launcher and Core Engine
How NewGen-AV starts from a small launcher, initializes the CoreEngine, owns the main components, and moves normalized events through a queue.
Introduction to the series
NewGen-AV is my way of studying endpoint security from both sides of the line: building a personal defensive tool for my own machine, then using realistic offensive techniques to understand where detection works, where it fails, and what needs to be improved.
