{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:U5CGCQIY32YO74VPDG4EE5GQU4","short_pith_number":"pith:U5CGCQIY","canonical_record":{"source":{"id":"2210.02821","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-10-06T11:25:05Z","cross_cats_sorted":["cs.OS"],"title_canon_sha256":"467b54e481c145fd1b919d84ca6ca9330a657dc347be42907b0c88c33ac0cd84","abstract_canon_sha256":"4f38fdb21e1b09eb5907268f011c52c19b98dba75ccdec31361c51b4f62d84b4"},"schema_version":"1.0"},"canonical_sha256":"a744614118deb0eff2af19b84274d0a724e6b0e524ff1972835ed34d1dd0b308","source":{"kind":"arxiv","id":"2210.02821","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2210.02821","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"arxiv_version","alias_value":"2210.02821v1","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2210.02821","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_12","alias_value":"U5CGCQIY32YO","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_16","alias_value":"U5CGCQIY32YO74VP","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_8","alias_value":"U5CGCQIY","created_at":"2026-07-05T05:03:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:U5CGCQIY32YO74VPDG4EE5GQU4","target":"record","payload":{"canonical_record":{"source":{"id":"2210.02821","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-10-06T11:25:05Z","cross_cats_sorted":["cs.OS"],"title_canon_sha256":"467b54e481c145fd1b919d84ca6ca9330a657dc347be42907b0c88c33ac0cd84","abstract_canon_sha256":"4f38fdb21e1b09eb5907268f011c52c19b98dba75ccdec31361c51b4f62d84b4"},"schema_version":"1.0"},"canonical_sha256":"a744614118deb0eff2af19b84274d0a724e6b0e524ff1972835ed34d1dd0b308","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T05:03:57.463248Z","signature_b64":"ap4f+pyhG8Vv+lTLEbzx/lh8bdGcDFND4GvOx7D9s/Ht0GP9SFx1HrTUsvXtV7dE9AAMreTZ6k+H/zae6YZdBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a744614118deb0eff2af19b84274d0a724e6b0e524ff1972835ed34d1dd0b308","last_reissued_at":"2026-07-05T05:03:57.462830Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T05:03:57.462830Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2210.02821","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:03:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DcONsj0jfyn8HboPuXvSJXOCxqDmEJTFjuCurHYFK9ECHk++dqUdMcyo5fgQeIOLKYRTqfKiTwcUaKDtoGEJAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T05:18:28.412778Z"},"content_sha256":"55866bed6be367949ccb85fb0f43bb1c24af9b29efa46151a4a7b770749ce875","schema_version":"1.0","event_id":"sha256:55866bed6be367949ccb85fb0f43bb1c24af9b29efa46151a4a7b770749ce875"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:U5CGCQIY32YO74VPDG4EE5GQU4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Microsoft Defender Will Be Defended: MemoryRanger Prevents Blinding Windows AV","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.OS"],"primary_cat":"cs.CR","authors_text":"Denis Pogonin, Igor Korkin","submitted_at":"2022-10-06T11:25:05Z","abstract_excerpt":"Windows OS is facing a huge rise in kernel attacks. An overview of popular techniques that result in loading kernel drivers will be presented. One of the key targets of modern threats is disabling and blinding Microsoft Defender, a default Windows AV. The analysis of recent driver-based attacks will be given, the challenge is to block them. The survey of user- and kernel-level attacks on Microsoft Defender will be given. One of the recently published attackers techniques abuses Mandatory Integrity Control (MIC) and Security Reference Monitor (SRM) by modifying Integrity Level and Debug Privile"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2210.02821","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2210.02821/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T05:03:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"36xTze7ElYZIDAGNJx6gCpDVJrPDckCPgxY8oaK0ud/xzKpiEPvhcUA7tOOu4iybQNGc3h2l2fYD4tZe9JJ+CQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T05:18:28.413355Z"},"content_sha256":"cb5957165ca96c1b2ba220211939b7598a1bb36b291c9036920d585aa8edb3f5","schema_version":"1.0","event_id":"sha256:cb5957165ca96c1b2ba220211939b7598a1bb36b291c9036920d585aa8edb3f5"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/U5CGCQIY32YO74VPDG4EE5GQU4/bundle.json","state_url":"https://pith.science/pith/U5CGCQIY32YO74VPDG4EE5GQU4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/U5CGCQIY32YO74VPDG4EE5GQU4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T05:18:28Z","links":{"resolver":"https://pith.science/pith/U5CGCQIY32YO74VPDG4EE5GQU4","bundle":"https://pith.science/pith/U5CGCQIY32YO74VPDG4EE5GQU4/bundle.json","state":"https://pith.science/pith/U5CGCQIY32YO74VPDG4EE5GQU4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/U5CGCQIY32YO74VPDG4EE5GQU4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:U5CGCQIY32YO74VPDG4EE5GQU4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4f38fdb21e1b09eb5907268f011c52c19b98dba75ccdec31361c51b4f62d84b4","cross_cats_sorted":["cs.OS"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-10-06T11:25:05Z","title_canon_sha256":"467b54e481c145fd1b919d84ca6ca9330a657dc347be42907b0c88c33ac0cd84"},"schema_version":"1.0","source":{"id":"2210.02821","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2210.02821","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"arxiv_version","alias_value":"2210.02821v1","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2210.02821","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_12","alias_value":"U5CGCQIY32YO","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_16","alias_value":"U5CGCQIY32YO74VP","created_at":"2026-07-05T05:03:57Z"},{"alias_kind":"pith_short_8","alias_value":"U5CGCQIY","created_at":"2026-07-05T05:03:57Z"}],"graph_snapshots":[{"event_id":"sha256:cb5957165ca96c1b2ba220211939b7598a1bb36b291c9036920d585aa8edb3f5","target":"graph","created_at":"2026-07-05T05:03:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2210.02821/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Windows OS is facing a huge rise in kernel attacks. An overview of popular techniques that result in loading kernel drivers will be presented. One of the key targets of modern threats is disabling and blinding Microsoft Defender, a default Windows AV. The analysis of recent driver-based attacks will be given, the challenge is to block them. The survey of user- and kernel-level attacks on Microsoft Defender will be given. One of the recently published attackers techniques abuses Mandatory Integrity Control (MIC) and Security Reference Monitor (SRM) by modifying Integrity Level and Debug Privile","authors_text":"Denis Pogonin, Igor Korkin","cross_cats":["cs.OS"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-10-06T11:25:05Z","title":"Microsoft Defender Will Be Defended: MemoryRanger Prevents Blinding Windows AV"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2210.02821","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:55866bed6be367949ccb85fb0f43bb1c24af9b29efa46151a4a7b770749ce875","target":"record","created_at":"2026-07-05T05:03:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4f38fdb21e1b09eb5907268f011c52c19b98dba75ccdec31361c51b4f62d84b4","cross_cats_sorted":["cs.OS"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-10-06T11:25:05Z","title_canon_sha256":"467b54e481c145fd1b919d84ca6ca9330a657dc347be42907b0c88c33ac0cd84"},"schema_version":"1.0","source":{"id":"2210.02821","kind":"arxiv","version":1}},"canonical_sha256":"a744614118deb0eff2af19b84274d0a724e6b0e524ff1972835ed34d1dd0b308","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a744614118deb0eff2af19b84274d0a724e6b0e524ff1972835ed34d1dd0b308","first_computed_at":"2026-07-05T05:03:57.462830Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T05:03:57.462830Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ap4f+pyhG8Vv+lTLEbzx/lh8bdGcDFND4GvOx7D9s/Ht0GP9SFx1HrTUsvXtV7dE9AAMreTZ6k+H/zae6YZdBA==","signature_status":"signed_v1","signed_at":"2026-07-05T05:03:57.463248Z","signed_message":"canonical_sha256_bytes"},"source_id":"2210.02821","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:55866bed6be367949ccb85fb0f43bb1c24af9b29efa46151a4a7b770749ce875","sha256:cb5957165ca96c1b2ba220211939b7598a1bb36b291c9036920d585aa8edb3f5"],"state_sha256":"e0fd0f844746541bda5b94f10ef645d70c0dcefa7eacd07c090bca6876b548fa"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Yg+wnStrnY1PheOx6z2E7X0pZFXbQTmdS6QIr0NcKoOuV9ueWrnve1Lge7vOunrboD93i2MqEJp1FpBLVPkJBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T05:18:28.418697Z","bundle_sha256":"72985a37afbc5d6ba9c2b74fe515fb2c9dbe24d395d6197e1c266de78796d041"}}