Sandboxing Antimalware Products for Fun and Profit

Elastic Security discloses a flaw in Windows Protected Process Light (PPL) where an attacker can modify a PPL anti‑malware service's token to strip privileges and lower integrity, incapacitating the product without terminating it; the article includes a proof‑of‑concept, demonstration, a sample mitigation (PPLGuard), and notes Microsoft classified the issue as moderate but did not issue an immediate patch.