Chaining Microsoft binaries to get privileged primitives in Windows kernel

The talk opens with System Guard Runtime Monitor, a Defender extension built for integrity attestation that has since been disabled and removed from Windows. Its kernel driver, sgrm-agent.sys, routes requests through a single IOCTL dispatcher, and the speaker walks through its routines, including memory mapping and thread freezing. To reach them, a caller must run as a protected process under the broker's service identity and hold the one driver handle the broker opened.

The attack starts inside a protected process. The speaker revives a 2018 technique that abused a COM interface in WerFault Secure, which later Microsoft patches broke. Sideloading a vulnerable faultrep DLL restores that interface, and a shared section passed through a command-line argument lets a crafted thread context call WriteProcessMemory to plant shellcode in a DLL's code section. That shellcode duplicates the broker's driver handle, freezes every thread of the Defender engine for fifteen minutes, then restores them. A demo shows a test file that Defender normally flags going undetected during that window.

For defenders, the talk recommends blocking driver downgrades and vulnerable driver loads, and watching for privileged handle requests to protected processes, which a kernel object callback can strip. The freeze routine was removed in later driver builds, and Windows 11 25H2 no longer ships the driver, though the speaker says the chain can be adapted to load it as a service. Source code is public.