Finding the Filter Driver Behind High CPU in Unrelated Windows Processes

This post first appeared on the ET Ducky blog. I build ET Ducky, an RMM that reads ETW on Windows and eBPF on Linux. When a monitoring agent, powershell.exe, and Process Explorer all show high CPU at