Finally,
let's take a look at user‑mode services. This service is usually
responsible for consolidating all the telemetry from the different
data sources we covered previously, such as the kernel‑mode drivers,
API monitoring components, and ETW data feeds.
It will also be responsible for orchestrating the antivirus activities.
It will trigger scans and, in some cases, perform automated
file analysis using artificial intelligence.
It will be responsible for sending files and scripts to emulators and sandboxes,
as well as sending some of the telemetry to the cloud so that it can be
correlated with indicators of compromise and reputation services.