this could be useful for persistent cloud threats where reboot into SRTM isn't possible/practical
-
Show this thread
-
Replying to @dwizzzleMSFT
maybe start with learning antitamper in win 10 to not load the driver i want instead of defenders minifilter?pic.twitter.com/ZEl4RHFmQT
1 reply 0 retweets 2 likes -
-
-
Replying to @jonasLyk
Do you have an actual enforcement policy enabled? You may want to read uphttps://docs.microsoft.com/en-us/powershell/module/configci/set-hvcioptions?view=win10-ps …
1 reply 0 retweets 1 like -
Replying to @dwizzzleMSFT
To be honest- I have no idea if its enabled by default, I assume it is, but is there anyway you can see it? Its not really noticeable- mimikatz driver loads just fine on all default policies but the only microsoft one.
1 reply 0 retweets 2 likes -
Replying to @jonasLyk @dwizzzleMSFT
and I dont get it, if I want to infect a computer with a driver i just delete c:\windows\system32\codeintegrity\SIPolicy.p7b and it is disabled on next boot without any warning. Who is this meant to protect? End users? Or is to make attestions so game studios can see no cheat?
2 replies 0 retweets 2 likes -
Replying to @jonasLyk
Thats what uefi lock is for, as I said you should read the docs
1 reply 0 retweets 0 likes -
Replying to @dwizzzleMSFT
okay- so you are saying its not the end user you are protecting? Or do you want my mom to read UEFI docs to avoid getting infected?
1 reply 1 retweet 11 likes -
Replying to @jonasLyk @dwizzzleMSFT
I dont think many people get the current landscape of 3 letter acronym protection policies and what defender XXXX is currently or what it protects. There is now- what 3 different technologies to reject a driver from loading. Kernel-Mode Code Signing Policy, authenticode and HVIC
1 reply 0 retweets 3 likes
and the undocumented blacklist in drvmain.sdb that is enforced when enabling isolated core.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.