News for hackers. Stuff that matters.
Re:Windows Defender Antivirus and layered machine learning d... by ksk on Wednesday December 13, 2017 @06:58PM (#15918838)
>Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges?

Sure, just dump the security token for MsMpEng.exe. Here it is: https://pastebin.com/ukMPUWA7

IntegrityLevelIndex is 01, MandatoryPolicy is 0x3 , Privs are a subset of the full list.

https://www.nirsoft.net/kernel_struct/vista/TOKEN.html

https://msdn.microsoft.com/en-us/library/windows/desktop/bb5...

https://msdn.microsoft.com/en-us/library/windows/desktop/bb3...

https://msdn.microsoft.com/en-us/library/bb625963.aspx

There are no comments on this comment yet.