1---2name: windows-mitigations-bypass3description: Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI4---56# Windows Mitigations & Bypass78Defeating both **exploit mitigations** (ASLR/DEP/CFG/XFG/CET/ACG) and **platform security controls**9(WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection +10OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.1112## When to Activate1314- Fingerprinting a target's mitigation landscape before weaponizing an exploit15- Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain16- Bypassing application control (WDAC / App Control for Business) to run unsigned code17- Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation18- Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR19- Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state2021## Technique Map2223| Technique | ATT&CK | CWE | Reference | Script |24|-----------|--------|-----|-----------|--------|25| ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module) | T1211 | CWE-330 | references/memory-safety-mitigations.md | scripts/find_nonaslr_modules.py |26| DEP/NX bypass (ROP→VirtualProtect, ret2libc) | T1211 | CWE-119 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py |27| CFG/XFG bypass (valid-target dispatch gadget, type-hash collision) | T1211 | CWE-1240 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py |28| CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind) | T1211 | CWE-1419 | references/memory-safety-mitigations.md | scripts/Get-ProcessMitigationMap.ps1 |29| ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process) | T1211, T1055 | CWE-94 | references/acg-cig-dynamic-code.md | scripts/Get-ProcessMitigationMap.ps1 |30| WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload) | T1218 | CWE-693 | references/wdac-app-control-bypass.md | scripts/mitigation_recon.ps1 |31| ASR rule bypass (excluded path/process hollow, COM, syscalls) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/extract_asr_exclusions.py |32| AMSI bypass (amsiInitFailed, AmsiScanBuffer patch, hardware bp) | T1562.001 | CWE-693 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 |33| ETW blinding (EtwEventWrite patch, provider disable, NtTraceControl) | T1562.006 | CWE-778 | references/asr-amsi-etw-blinding.md | scripts/mitigation_recon.ps1 |34| PPL / LSA Protection bypass (PPLmedic userland chain, BYOVD) | T1003.001, T1562.001 | CWE-269 | references/ppl-lsa-protection.md | scripts/Get-ProcessMitigationMap.ps1 |35| BYOVD kernel R/W (unblocked driver, EPROCESS.Protection wipe) | T1068, T1562.001 | CWE-822 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py |36| VBS/HVCI/Credential Guard evasion (blocklist evasion, data-only) | T1068, T1562.001 | CWE-693 | references/byovd-vbs-hvci.md | scripts/check_driver_blocklist.py |3738## Quick Start3940```powershell41# 1. Fingerprint system + per-process mitigations, AMSI/ETW/ASR/WDAC/VBS state42powershell -ep bypass -f scripts/mitigation_recon.ps1 -OutJson recon.json43powershell -ep bypass -f scripts/Get-ProcessMitigationMap.ps1 # rank weak processes4445# 2. If memory-corruption target: locate non-ASLR modules + CFG-valid dispatch gadgets46python scripts/find_nonaslr_modules.py C:\Target\*.dll47python scripts/cfg_dispatch_gadget_finder.py target.dll # ROP/JOP under CFG/CET4849# 3. If application control (WDAC) blocks execution: pick a signed bypass vessel50# MSBuild inline C#, signed legacy Teams (Electron), or signed Node .node module5152# 4. Blind telemetry before post-ex (use sparingly — patching is itself an IOC)53# AMSI: patch AmsiScanBuffer / amsiInitFailed ETW: patch EtwEventWrite5455# 5. Credential access vs PPL/LSA: userland PPLmedic chain (no driver) or BYOVD56python scripts/extract_asr_exclusions.py # find ASR-excluded paths57python scripts/check_driver_blocklist.py mydriver.sys # is driver blocklisted/HVCI-safe?58```5960## OPSEC & Detection (summary)6162| Technique | Telemetry / IOC | Detection (Sigma / EDR) | OPSEC note |63|-----------|-----------------|--------------------------|------------|64| ROP/JOP exploit | crash dumps, WER, #CP/#PF exceptions, RWX alloc | EDR stack-walk on VirtualProtect/VirtualAlloc; CFG/CET #CP telemetry | prefer data-only; reuse signed gadgets; avoid RWX |65| WDAC LOLBin | 4688 w/ MSBuild/mshta parent, child of office/explorer | Sigma proc_creation_win_lolbin_*; CodeIntegrity 3076/3077 audit | use Microsoft-signed Electron/V8 — looks like normal app |66| AMSI patch | RWX in amsi.dll, AMSI scan gaps | AMSI bypass detections, mem scan of amsi.dll .text | indirect syscalls; restore bytes; HWBP avoids byte edits |67| ETW patch | EtwEventWrite first byte = 0xC3/0xCC | ETW-TI sensor; integrity scan of ntdll EtwEventWrite | restore after use; or disable provider not whole API |68| PPL LSASS dump | handle to lsass w/ VM_READ, MiniDump call, 4656/4663 | Sysmon 10 GrantedAccess 0x1010/0x1410; Defender ASR 9e6c... | userland PPLmedic avoids driver IOC; rename per ASR excl. |69| BYOVD | Sysmon 6 driver load, svc create reg, unsigned-by-MS driver | Sysmon EID6 + reg EID13; MDE LOLDrivers hash hunt; blocklist | pick driver NOT in MS blocklist/LOLDrivers; HVCI may still block |70| VBS/HVCI off | bcdedit hypervisorlaunchtype off, DeviceGuard reg writes | reg EID13 on DeviceGuard; boot config change events | requires admin+reboot — loud; data-only attack instead |7172## Deep Dives7374- **references/memory-safety-mitigations.md** — ASLR/HEASLR, DEP/NX, CFG/XFG, Intel CET shadow stack + IBT, SEHOP: how each works on Win11 24H2 and concrete bypass chains (info leak → dispatch gadget → VirtualProtect).75- **references/acg-cig-dynamic-code.md** — Arbitrary Code Guard, Code Integrity Guard, Dynamic Code policy: signed-code-only reuse, JIT/browser exemptions, cross-process pivots, SEC_IMAGE section abuse.76- **references/wdac-app-control-bypass.md** — WDAC / App Control for Business: recommended-block-rule LOLBins, signed Electron (Loki C2) + signed Node `.node`/V8 exploitation, DLL sideloading, allow-list reality check.77- **references/asr-amsi-etw-blinding.md** — ASR rule bypasses (global exclusion abuse, process hollowing into trusted images), AMSI bypass variants, ETW blinding (full patch vs selective provider disable).78- **references/ppl-lsa-protection.md** — PPL levels & LSA Protection (RunAsPPL), userland PPLmedic exploit chain, PPLBlade/nanodump dumping, Credential Guard reality, BYOVD PPL kill.79- **references/byovd-vbs-hvci.md** — BYOVD kernel R/W primitive build, Microsoft driver blocklist + LOLDrivers + HVCI/Secure Boot evasion (Silver Fox amsdk.sys case), VBS/Credential Guard limits, kernel shadow stack.
hypnguyen1209