AntimalwareBlight

Use this PowerShell module to execute PowerShell code at the antimalware-light protection level. This code was highlighted in the Living Off the Walled Garden: Abusing the Features of the Early Launch Antimalware Ecosystem REcon talk as well as Black Hat USA 2022. This module needs to run elevated. The purpose of this module is to highlight how the antimalware-light protection anti-tampering feature is only as strong as the weakest vendor's ELAM driver.

This is fully-weaponized by the inclusion of the target MSBuild.exe executable and the vulnerable ELAM driver, aswElam.sys that permits its execution at the antimalware-light protection level. These are both legitimate files used as primitives to achieve code execution as a protected process.

Note

In spite of aswElam.sys being an I386 (32-bit) driver, it will work on any processor architecture since it is only used by the kernel to read the ELAM metadata.

Disclosure timeline

Thank you to the Microsoft Defender research team for working with me on this issue! When in doubt, if MSRC won't fix something because it's not a security boundary, the Defender team still likely cares very much!

• Dec 29, 2021: Initial report to MSRC
• Jan 11, 2022: MSRC determined that it did not meet the servicing bar since it requires admin
• Jan 11, 2022: I responded and asked MSRC to ensure that the issue would be passed on the Microsoft Defender for Endpoint team
• Jun 2022: Released defanged weaponization script and presented findings at Recon and Black Hat USA.
• Sep 2026: Released fully-weaponized script. Nearly five years is sufficient time to wait.

Usage

Load the module:

Import-Module .\AntimalwareBlight.psm1

View its exported functions:

Get-Command -Module AntimalwareBlight

View help for the module's functions:

Get-Help Invoke-AntimalwareLightCommand -Full