News for hackers. Stuff that matters.

A comment on Hiding execution of unsigned code in Windows system threads. Parent comment

Re:Hiding execution of unsigned code in Windows system threads by smileybarry on Wednesday January 13, 2021 @02:19PM (#25766734)
That's two separate mechanisms; PatchGuard protects against hooking and rewriting sections of the kernel, and the kernel only loads signed drivers (and since 2016-ish only Microsoft-signed).
[ Parent | on HN ]

There are no comments on this comment yet.