Loading story…
Elastic Security Labs disclosed two Windows zero-day exploit paths that enable attackers with local administrator privileges to bypass Protected Process Light (PPL) protections and escalate from PPL to kernel-level execution. The PPLFault and GodFault techniques can disable Windows Defender and other AV/EDR controls without a bring-your-own-vulnerable-driver (BYOVD) component, undermining controls intended to restrict administrator-driven kernel tampering.
The techniques operate despite Windows defenses including Driver Signing Enforcement, Secure Boot, and the Vulnerable Driver Blocklist, which limit untrusted kernel drivers but do not prevent this driverless exploit chain. Microsoft reportedly declined to patch the issues because exploitation requires administrator access; Elastic released the NoFault kernel driver as an interim PPL mitigation and integrated protection into Elastic Endpoint/Defend version 8.9.0 and later, while the underlying kernel escalation remained unpatched.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
After the researcher announced a Black Hat Asia 2023 presentation on PPLdump, the Windows Defender team contacted them for details, indicating MSRC had not informed that team of the PPL bypass.
The researcher reported an administrator-to-Protected Process Light bypass and a PPL-to-kernel exploit path to Microsoft Security Response Center under case VULN-074311, including source code for both exploits.
Microsoft introduced Driver Signing Enforcement with Windows Vista x64 to restrict the loading of arbitrary kernel drivers.
The researcher released the NoFault kernel driver as an interim mitigation for the PPL exploit, and Elastic Endpoint/Defend 8.9.0 and later incorporated NoFault-based protection. The mitigation breaks the exploit chain but does not remediate the underlying kernel vulnerability.
The researcher released the PPLFault administrator-to-PPL exploit and the GodFault administrator-to-kernel exploit chain, along with a driverless EDRSandBlast variant integrating PPLFault that was demonstrated disabling the Windows Defender driver.
MSRC declined further action because the attack chain required administrator privileges and did not meet its threshold for immediate servicing.
Microsoft began enabling the Vulnerable Driver Blocklist by default with Windows 11 version 22H2.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourceelastic.co
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs warned that ransomware operators increasingly use legitimately signed but vulnerable Windows drivers to gain kernel-mode execution, tamper with endpoint defenses, and encrypt systems. The researchers identified an unrestricted handle-duplication flaw in the Microsoft Sysinternals Process Explorer driver that a user-mode attacker could exploit to access raw physical memory, enabling arbitrary kernel read/write operations or kernel code execution. Organizations should treat vulnerable signed drivers as a high-risk attack path and block known-abused drivers before they load. Elastic recommends combining vulnerable-driver blocklists, Windows Defender Application Control (WDAC) driver allowlisting, behavioral protections, and monitoring for first-seen or anomalous driver loads; Elastic Endpoint 8.3 and later validates drivers against its blocklist prior to loading.
Aug 26, 2026
Fortinet disclosed two techniques that can let attackers load unsigned kernel drivers on Windows systems by tampering with **Driver Signature Enforcement (DSE)** at runtime, despite protections such as Code Integrity, PatchGuard, Virtualization-based Security, and Microsoft’s recommended vulnerable-driver block rules. The methods, dubbed **Page Swapping** and **Callback Swapping**, abuse kernel write access—often obtained through vulnerable third-party drivers—to redirect protected Code Integrity policy data or replace validation callbacks in `ntoskrnl.exe`, causing malicious drivers to be accepted as trusted. The report says Microsoft’s **Kernel Data Protection (KDP)** and driver blocklists raise the bar but do not fully stop runtime DSE tampering when **Hypervisor-protected Code Integrity (HVCI)** is not enabled, because driver validation can still be manipulated in the normal kernel. The findings build on a long history of DSE bypass tradecraft, including Turla-linked tooling such as **TDL**, a loader that mapped specially crafted unsigned drivers into kernel memory without modifying standard Code Integrity variables, underscoring how kernel-level access and vulnerable drivers remain a practical path to stealthy persistence and defense evasion on Windows.
Aug 15, 2026
Microsoft disclosed multiple Windows local privilege escalation vulnerabilities affecting kernel-level drivers, including **Windows Common Log File System (CLFS) Driver** flaws tracked as `CVE-2023-23376` and `CVE-2023-28252`, as well as a **Windows Cloud Files Mini Filter Driver** flaw tracked as `CVE-2025-62454`. All three issues were classified as **Elevation of Privilege** vulnerabilities in Microsoft's Security Update Guide. The advisories indicate that successful exploitation could allow an attacker who already has access to a target system to gain higher privileges through vulnerable Windows driver components. The affected bugs span separate Windows subsystems but share the same core risk: attackers can abuse low-level driver weaknesses to move from limited access toward more powerful control over compromised machines, reinforcing the need to prioritize Microsoft security updates for Windows kernel and file-system-related components.
Jul 12, 2026