/PPIDSpoof

PPID Spoofing and blocking Non-Microsoft DLLs POC in C#

Primary LanguageC#

PPID Spoofing and Blocking DLLs in C#

Using InitializeProcThreadAttributeList and UpdateProcThreadAttribute to update attributes of the process to change parent PID and add PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON.

Demo:

Demo Attributes
Demo DLLs
Look at the blog here to understand what is happening.

TODO:

  • Figure out a way to make the process window hidden if the process doesnt exist already.