Windows Security Boundaries

When to Activate

• Planning a privilege-escalation path that crosses a Windows security boundary (integrity level, AppContainer/LPAC, PPL, or the kernel/user line)
• Sandbox-escape research: browser renderer (Chromium/Edge Mojo), Office WebView, packaged apps, AppContainer/LPAC brokers
• Reaching Ring 0 via win32k/dxgkrnl bugs or BYOVD for a kernel read/write primitive
• Defeating PPL to dump LSASS or tamper with EDR self-defense
• Going from a SeImpersonate service account to SYSTEM via RPC/ALPC/named-pipe abuse
• UAC bypass (Medium → High) via auto-elevating COM or registry hijack

Boundary stack (high → low): VTL1 (Secure Kernel/Cred Guard) > Ring 0 (ntoskrnl/win32k/drivers) > Ring 3: System > High > Medium > Low > AppContainer/LPAC. PPL is an orthogonal wall guarding LSASS/EDR even from SYSTEM.

Technique Map