protected-processes

Protected processes (PP/PPL) are a Windows security mechanism that restricts which processes can be terminated or tampered with, even by kernel-level code. Discussions on this tag center on real-world attacks that bypass these protections, such as the Silver Fox campaign using a signed but vulnerable kernel driver (amsdk.sys) to kill security software and deploy ValleyRAT. These exploits highlight ongoing challenges in maintaining process integrity against driver-based threats. Topics include how PP/PPL works, its limitations, and defensive strategies like enabling HVCI and monitoring for driver abuse. The tag is relevant for IT security professionals and Windows administrators concerned with endpoint protection and kernel-level attack vectors.