Loading story…
Microsoft patched the Windows user-mode Protected Process Light (PPL) Known DLL loading behavior abused by PPLdump to inject arbitrary code into protected processes, including LSASS. The technique relied on creating a malicious \KnownDlls symbolic link through arbitrary object-directory creation, an exploitation primitive previously documented by Google Project Zero for local privilege escalation scenarios.
Testing on Windows 10 21H2 build 19044.1826 showed PPLdump could still create the malicious symbolic link, but the protected target process no longer loaded the hijacked DLL. Analysis of NTDLL identified a change in LdrpInitializeProcess, controlled by Feature_Servicing_2206c_38427506__private_IsEnabled, that makes both Protected Processes and PPLs bypass Known DLLs. The update closes this specific user-mode PPL bypass, though other weaknesses affecting PPL protections may remain.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Testing on Windows 10 21H2 build 19044.1826 with the July 2022 update reproduced PPLdump's failure: the malicious KnownDlls link could be created, but the protected target process did not load the hijacked DLL.
Microsoft changed NTDLL's loader behavior so Protected Process Light processes can avoid Known DLLs when a servicing feature is enabled, closing the Known DLL hijacking weakness abused by PPLdump.
Google Project Zero published research on exploiting arbitrary object-directory creation for local elevation of privilege in Windows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft added Code Integrity page-hash validation for executable images hosted on remote devices in Windows Insider Canary build 25941, mitigating the **PPLFault** zero-day. The flaw abused the Cloud Filter API and unvalidated paging of SMB-hosted DLLs, allowing an attacker who already held administrator privileges to inject unsigned code into highly privileged `WinTcb-Light` Protected Process Light (PPL) processes. PPLFault could bypass LSA protection and terminate or blind endpoint detection and response products. Its companion **GodFault** exploit chained PPLFault with a PPL-to-kernel vulnerability to alter kernel memory and gain physical-memory read/write access. The new validation causes altered remotely hosted payload DLLs to fail integrity checks, preventing injection; the change was initially released in an Insider pre-release build, with general-availability rollout not assured at the time.
Sep 9, 2026
Elastic Security Labs disclosed two Windows zero-day exploit paths that enable attackers with local administrator privileges to bypass Protected Process Light (PPL) protections and escalate from PPL to kernel-level execution. The `PPLFault` and `GodFault` techniques can disable Windows Defender and other AV/EDR controls without a bring-your-own-vulnerable-driver (BYOVD) component, undermining controls intended to restrict administrator-driven kernel tampering. The techniques operate despite Windows defenses including Driver Signing Enforcement, Secure Boot, and the Vulnerable Driver Blocklist, which limit untrusted kernel drivers but do not prevent this driverless exploit chain. Microsoft reportedly declined to patch the issues because exploitation requires administrator access; Elastic released the NoFault kernel driver as an interim PPL mitigation and integrated protection into Elastic Endpoint/Defend version 8.9.0 and later, while the underlying kernel escalation remained unpatched.
Aug 26, 2026
Microsoft has addressed a long-standing security vulnerability in Windows shortcut (.LNK) files, identified as CVE-2025-9491, which allowed attackers to hide malicious commands within shortcut files using whitespace and other characters. This flaw, actively exploited since at least 2017 by multiple state-sponsored threat actors from China, Iran, North Korea, and Russia, enabled remote code execution by concealing hazardous content from users inspecting file properties in the Windows interface. The vulnerability was finally patched as part of Microsoft's November 2025 Patch Tuesday, following public disclosures and pressure from security researchers and organizations such as Trend Micro and ACROS Security's 0patch. The issue was initially dismissed by Microsoft as not meeting the threshold for immediate servicing, despite evidence of widespread abuse in espionage and financially motivated campaigns. Security researchers demonstrated that the flaw allowed attackers to disguise malicious .LNK files as harmless documents, bypassing user scrutiny and leveraging the Windows UI's limitations. While Microsoft eventually issued a silent patch to address the visibility of malicious commands, third-party vendors like 0patch released their own fixes, claiming enhanced protection against known attack techniques. The vulnerability's exploitation history and the delayed response highlight ongoing challenges in prioritizing and remediating UI-based security flaws in widely used operating systems.
Jul 23, 2026