Interesting idea: https://linuxplumbersconf.org/event/7/contributions/739/attachments/655/1204/LPC-MC_DRTM_Advanced_Applications.pdf …pic.twitter.com/zVkoetrJvC
Show this thread
-
To be honest- I have no idea if its enabled by default, I assume it is, but is there anyway you can see it? Its not really noticeable- mimikatz driver loads just fine on all default policies but the only microsoft one.
and I dont get it, if I want to infect a computer with a driver i just delete c:\windows\system32\codeintegrity\SIPolicy.p7b and it is disabled on next boot without any warning. Who is this meant to protect? End users? Or is to make attestions so game studios can see no cheat?
-
-
I have no idea if its bypassable with the only microsoft policy - because I cannot see if a driver is loaded. My computer is unuseable without filetest, proesshacker and everything(search tool that do it right).
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Thats what uefi lock is for, as I said you should read the docs
-
okay- so you are saying its not the end user you are protecting? Or do you want my mom to read UEFI docs to avoid getting infected?
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.