pp-ppl

The pp-ppl tag covers discussions about Windows Protected Processes (PP) and Protected Process Light (PPL), a security feature that restricts access to critical system processes. Content under this tag includes analysis of attacks that bypass PP/PPL protections, such as the Silver Fox campaign using a signed but vulnerable kernel driver (amsdk.sys) to terminate security processes and deliver ValleyRAT. These discussions highlight how threat actors exploit driver vulnerabilities to undermine Windows kernel defenses, including Kernel Mode Code Integrity (KMCI) and Hypervisor-protected Code Integrity (HVCI). The tag is relevant for IT security professionals and Windows users interested in understanding and mitigating advanced kernel-level threats.