How To Bypass AM-PPL & Disable EDRs - A Red Teamer's Story-Stephen Kho & Juan Sacco | Nullcon Berlin

This talk introduces the Antimalware Protected Process Light (AM-PPL) technology implemented in Windows 8.1, which aims to ensure that only trusted services and processes are loaded by the operating system. The speakers explore the effectiveness of AM-PPL and investigate potential abuse scenarios that may allow bypassing antivirus and endpoint detection and response (EDR) products. Stephen, the Red Team lead at Avast, and Juan Sacco, co-team lead, leverage their extensive backgrounds in security and exploitation to share insights and findings from their research on this critical security technology.