Windows Mitigations & Bypass

Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.

When to Activate

• Fingerprinting a target's mitigation landscape before weaponizing an exploit
• Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain
• Bypassing application control (WDAC / App Control for Business) to run unsigned code
• Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation
• Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR
• Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state

Technique Map