0xv1n.github.iowriteupKernel Drivers, Process Protection, and ...Bears?
A technical deep-dive into Windows Protected Process Light (PPL) and its role protecting lsass.exe from memory access/code injection by non-protected processes, walking through the LSA protection hierarchy, registry (RunAsPPL) and GPO configuration, and the author's journey toward exploiting/disabling PPL protection using kernel driver techniques inspired by prior work like Mimikatz's driver. It covers Microsoft's official protections (KB guidance, UEFI lock/Secure Boot) and practical notes on why lsass.exe dumping fails at the kernel level versus EDR interference.
TL;DR Deep dive into Windows PPL internals and kernel-driver techniques for disabling lsass.exe process protection.
Organisations named here
- Benjamin Delpy
Technologies named here
- Mimikatz
- Windows
- LSASS
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup