T1543 Create or Modify System Process Mappings

Windows Kernel Data Protection uses VBS (Intel PTT, Intel VT-x, Intel VT-d, Intel VT-rp, and Intel BootGuard) to protect kernel data, kernel data structures, and OS drivers from tampering attacks. With KDP, software running in kernel-mode can protect read-only memory statically (a section of its own image) or dynamically (pool memory that can be initialized only once). KDP only establishes write protections in VTL1 for the GPAs backing a protected memory region using the SLAT page tables for the hypervisor to enforce. This way, no software running in the NT kernel (VTL0) can have the permissions needed to change the memory. The goal of using KDP is to protect internal policy state after it has been initialized (i.e., read from the registry or generated at boot time). These data structures are critical to protect as if they are tampered with a driver that is properly signed but vulnerable could attack the policy data structures and then install an unsigned driver on the system. With KDP, this attack is mitigated by ensuring the policy data structures cannot be tampered with. The score of significant highlights this real-time protection of the kernel data, data structures, and drivers from tampering attacks. HW Enforced stack protection (HWESP) relies on Virtualization Based Security (VBS) which use Intel PTT, Intel VT-x, Intel VT-d and Intel BootGuard to ensure the OS components loaded are not tampered with and isolate security sensitive processes. Additionally, it uses Intel Control Flow Enforcement Technology (Intel CET) to allow hardware to ensure that sensitive areas in the regions of memory (such as the stack) for processes are not tampered with by either injecting code or changing the control flow of the code or both. HWESP includes four components Code Integrity Guard, Arbitrary Code Guard, Control Flow Guard and Shadow Stack protections. Code Integrity Guard attempts to prevent "... arbitrary code generation by enforcing signature requirements for loading binaries". Arbitrary Code Guard attempts to ensure "... signed pages are immutable and dynamic code cannot be generated ...". Control Flow Guard ensures control flow integrity by enforcing "... integrity on indirect calls (forward-edge CFI)." Shadow Stack ensures control flow integrity by enforcing "... integrity on return addresses on the stack (backward-edge CFI)." Together these features aim to ensure integrity of binary images run on Windows 11 and prevent dynamic code from running or changing the control flow of the code. Since these features offer real-time protection for sensitive regions of memory, these are marked as offering significant protection. The Vulnerable Driver Blocklist uses Virtualization Based Security (VBS) Memory Integrity feature or HVCI, which in turn rely on Intel PTT, Intel VT-x, Intel VT-d and Intel BootGuard to create an isolated virtual environment for the kernel such that attacks from vulnerable drivers are prevented. It uses a deny list approach along with code signing checks to ensure vulnerable drivers are not modified and to prevent attacks against them. "... the vulnerable driver blocklist is also enforced when either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode is active." "The blocklist is updated with each new major release of Windows, typically 1-2 times per year..." "Memory integrity and virtualization-based security (VBS) improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows kernel. VBS uses the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Memory integrity is a critical component that protects and hardens Windows by running kernel mode code integrity within the isolated virtual environment of VBS."

Windows Kernel Data Protection uses VBS (Intel PTT, Intel VT-x, Intel VT-d, Intel VT-rp, and Intel BootGuard) to protect kernel data, kernel data structures, and OS drivers from tampering attacks. With KDP, software running in kernel-mode can protect read-only memory statically (a section of its own image) or dynamically (pool memory that can be initialized only once). KDP only establishes write protections in VTL1 for the GPAs backing a protected memory region using the SLAT page tables for the hypervisor to enforce. This way, no software running in the NT kernel (VTL0) can have the permissions needed to change the memory. The goal of using KDP is to protect internal policy state after it has been initialized (i.e., read from the registry or generated at boot time). These data structures are critical to protect as if they are tampered with a driver that is properly signed but vulnerable could attack the policy data structures and then install an unsigned driver on the system. With KDP, this attack is mitigated by ensuring the policy data structures cannot be tampered with. The score of significant highlights this real-time protection of the kernel data, data structures, and drivers from tampering attacks. HW Enforced stack protection (HWESP) relies on Virtualization Based Security (VBS) which use Intel PTT, Intel VT-x, Intel VT-d and Intel BootGuard to ensure the OS components loaded are not tampered with and isolate security sensitive processes. Additionally, it uses Intel Control Flow Enforcement Technology (Intel CET) to allow hardware to ensure that sensitive areas in the regions of memory (such as the stack) for processes are not tampered with by either injecting code or changing the control flow of the code or both. HWESP includes four components Code Integrity Guard, Arbitrary Code Guard, Control Flow Guard and Shadow Stack protections. Code Integrity Guard attempts to prevent "... arbitrary code generation by enforcing signature requirements for loading binaries". Arbitrary Code Guard attempts to ensure "... signed pages are immutable and dynamic code cannot be generated ...". Control Flow Guard ensures control flow integrity by enforcing "... integrity on indirect calls (forward-edge CFI)." Shadow Stack ensures control flow integrity by enforcing "... integrity on return addresses on the stack (backward-edge CFI)." Together these features aim to ensure integrity of binary images run on Windows 11 and prevent dynamic code from running or changing the control flow of the code. Since these features offer real-time protection for sensitive regions of memory, these are marked as offering significant protection. The Vulnerable Driver Blocklist uses Virtualization Based Security (VBS) Memory Integrity feature or HVCI, which in turn rely on Intel PTT, Intel VT-x, Intel VT-d and Intel BootGuard to create an isolated virtual environment for the kernel such that attacks from vulnerable drivers are prevented. It uses a deny list approach along with code signing checks to ensure vulnerable drivers are not modified and to prevent attacks against them. "... the vulnerable driver blocklist is also enforced when either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode is active." "The blocklist is updated with each new major release of Windows, typically 1-2 times per year..." "Memory integrity and virtualization-based security (VBS) improve the threat model of Windows and provide stronger protections against malware trying to exploit the Windows kernel. VBS uses the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Memory integrity is a critical component that protects and hardens Windows by running kernel mode code integrity within the isolated virtual environment of VBS."

Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), strengthens cybersecurity defenses by enabling faster, real-time detection of "Create or Modify System Process" attacks. This integrated solution enhances CrowdStrike Falcon, allowing it to detect and mitigate cyber threats earlier in the kill chain while minimizing system performance impact. "Create or Modify System Process" attacks involve adversaries creating new processes or modifying existing system processes to execute malicious code, escalate privileges, or maintain persistence within the system. Attackers often exploit system vulnerabilities, misconfigurations, or weak security controls to alter process behaviors and bypass security defenses. Intel TDT plays a crucial role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, allowing for rapid detection of abnormal behaviors that could indicate the creation or manipulation of system processes for malicious purposes. Additionally, CAMS offloads memory scanning tasks from the CPU to the Intel Integrated GPU, enabling faster, more efficient detection of malicious activity without degrading system performance. CAMS helps identify suspicious behaviors, such as unauthorized process creation or modifications to critical system processes, providing proactive defense against attacks designed to compromise or manipulate essential system functions.