Created total BYOVD Kernel-level protection for Windows using Windows Defender Application Control and WDACConfig module

This content can be used by both blue and purple teams.

This scenario involves removing the trust to any Kernel mode driver, whether they are vulnerable or not. **It does not affect User-mode binaries or drivers.**

Any 3rd party software or hardware Kernel mode driver needs to be explicitly allowed. This scenario protects against all BYOVD scenarios and much more.

Drivers can access the Kernel which is the core of the operating system. Microsoft requires all drivers to be digitally …

application application control blue blueteamsec byovd control defender driver drivers hardware kernel mode party protection purple scenario software teams trust vulnerable windows windows defender windows defender application control