Name: RVAsec Deep Dive - Attacking File System Mini Filters
Start: 2025-11-13T18:00:00-05:00
End: 2025-11-13T20:00:00-05:00
Location: Ours

This session with [Ali Ahmad](https://www.linkedin.com/in/aahmad097/) takes us deep into the internals of Windows file system mini-filters, focusing on cldflt.sys—the driver behind Windows cloud synchronization. You’ll get a practical look at how cloud sync operations like hydration and placeholder management expose potential attack surfaces in the kernel.

Through a mix of theory and real-world case studies, we’ll examine how vulnerabilities are discovered in mini-filters, review notable CVEs from 2020–2025, and walk through techniques used in fuzzing, reverse engineering, and debugging. Attendees will gain an understanding of how researchers uncover bugs in Windows kernel components and how to approach driver-level analysis safely in a lab setting.

If you’ve ever wanted to understand how kernel-mode file operations can lead to privilege escalation, or how researchers weaponize fuzzing frameworks against Windows internals; this one’s for you.

**Location:**
Ours - Coworking space
2309 W Main St, Richmond, VA 23220
https://ours.today/

**Agenda:**
• 6pm–6:45pm – Intro to Driver Bug Hunting
• 6:45pm–7pm – Break
• 7pm–8pm – Attacking File System Mini-Filters
• 8pm – Questions and social

**Capacity:**
We expect roughly 30 seats. If you sign up, please show up; if something comes up, no problem, but cancel or update ASAP so someone else can take the spot.

**Parking:**
Please note that this location only has street parking. Our contact shared that they never has trouble finding a spot. We hope this is the case for our meeting as well.

Jake Kouns

Austin

RVAsec Security Community

RVAsec

Technology

Security Industry

Open Source

Network Security

Entrepreneurship

Web Security

Data Science

Cybersecurity

Information Security

Application Security

Cloud Security

Ethical Hacking

Web Application Security

Software Security

Computer Security

Ali Ahmad is a Security Researcher at Margin Research, specializing in vulnerability discovery and reverse engineering. With over seven years of experience in the security industry, his background spans full-scope red team operations, kernel driver analysis, and exploit development. Prior to joining Margin Research, Ali served as a Senior Research Consultant at Atredis Partners and a Security Consultant at Optiv, where he conducted advanced adversarial simulations and penetration testing engagements.

Ali’s research focuses on Windows internals, kernel attack surfaces, and fuzzing techniques. His work has led to multiple CVE discoveries across Microsoft’s cloud synchronization and file system components. Outside of work, he contributes to the community through open-source tooling, conference talks, and technical write-ups on vulnerability research.

Ali Ahmad

RVAsec Deep Dive - Attacking File System Mini Filters

Ours

Share

RVAsec Security Community

RVAsec Deep Dive - Attacking File System Mini Filters

RVAsec Security Community

Details

Members are also interested in