
PPLRunner
Builds an ELAM driver and service that launches a signed child process as an Anti-Malware Protected Process-Light (PPL) on Windows, for security…
defensive-toolsexploitationmalware-analysis+4
185

Builds an ELAM driver and service that launches a signed child process as an Anti-Malware Protected Process-Light (PPL) on Windows, for security…

Windows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).

A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.

Lightweight RAT providing silent remote command-line access, hidden file download/execution, and persistence mechanisms for Windows systems.…