# Sandboxing Antimalware Products for Fun and Profit

Windows PPL anti-malware processes' tokens lack protection, allowing SYSTEM to strip privileges and integrity, disabling Defender.

- Payout: Research
- Severity: medium
- Program: Windows
- Credited: Gabriel Landau
- Disclosed: 2023-02-21
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/sandboxing-antimalware-products
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products
- Tags: impact:integrity impact:privesc kind:research platform:threat-intel sev:medium technique:source-review vuln:access-control vuln:privilege-escalation

**Target:** Windows Protected Process Light (PPL) anti-malware services
**Root cause:** PPL processes' tokens are not protected by trust labels, so a SYSTEM thread can open and modify them, removing privileges and lowering integrity.
**Steps:**
1. Obtain SYSTEM privileges on Windows.
2. Open handle to MsMpEng.exe with PROCESS_QUERY_LIMITED_INFORMATION.
3. Call OpenProcessToken to get token handle (works despite MSDN requiring PROCESS_QUERY_INFORMATION).
4. Use AdjustTokenPrivileges to remove all privileges from the token.
5. Use SetTokenInformation to set token integrity level to untrusted.
6. Execute Mimikatz; Defender fails to detect/block it.
**How found:** Observed that PPL blocks PROCESS_TERMINATE but not token access; noted MSDN discrepancy about OpenProcessToken rights; inspected token DACL showing SYSTEM has full control; hypothesized token modification possible.
**Exploitation:** Attacker with SYSTEM privileges opens the token of a PPL anti-malware process (e.g., MsMpEng.exe) using only PROCESS_QUERY_LIMITED_INFORMATION, then removes all privileges and sets integrity to untrusted, incapacitating the security product without terminating it.
**Insight:** When a protection mechanism blocks one access right (e.g., PROCESS_TERMINATE), check adjacent securable objects like tokens for missing protections; documentation may understate required access rights.