What about Driver Signature Enforcement? are you replacing the driver with something signed/approved?
Allright, I am now able to change the driver that gets loaded for Defenders minifilter. Only way to detect it is to look at the data in memory - it is shown with the normal filename etc. Oh- with secure boot and isolated core of course. Talk about a nasty persistence method?pic.twitter.com/etI1Aikzip
-
-
-
Mainly curious if the driver is still loaded with NtLoadDriver and subject to Driver Signature Enforcement
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.