Interesting idea: https://linuxplumbersconf.org/event/7/contributions/739/attachments/655/1204/LPC-MC_DRTM_Advanced_Applications.pdf …pic.twitter.com/zVkoetrJvC
Show this thread
-
Do you have an actual enforcement policy enabled? You may want to read uphttps://docs.microsoft.com/en-us/powershell/module/configci/set-hvcioptions?view=win10-ps …
To be honest- I have no idea if its enabled by default, I assume it is, but is there anyway you can see it? Its not really noticeable- mimikatz driver loads just fine on all default policies but the only microsoft one.
-
-
and I dont get it, if I want to infect a computer with a driver i just delete c:\windows\system32\codeintegrity\SIPolicy.p7b and it is disabled on next boot without any warning. Who is this meant to protect? End users? Or is to make attestions so game studios can see no cheat?
-
I have no idea if its bypassable with the only microsoft policy - because I cannot see if a driver is loaded. My computer is unuseable without filetest, proesshacker and everything(search tool that do it right).
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.