
criPPLe
Windows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).
exploitationmalware-analysisprivilege-escalation+1

Windows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).
A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.

Lightweight RAT providing silent remote command-line access, hidden file download/execution, and persistence mechanisms for Windows systems.…