windows-mitigations-bypass

name	windows-mitigations-bypass
description	Use when bypassing a Windows exploit/platform mitigation — ASLR/DEP/CFG/XFG/CET, ACG/CIG, WDAC/App Control, ASR/AMSI/ETW, PPL/LSA Protection, BYOVD/VBS/HVCI
metadata	{"type":"offensive","phase":"exploitation","tools":["WinDbg","IDA","x64dbg","Process Hacker","ROPgadget","mona.py","PPLmedic","nanodump","EDRSandblast"],"mitre":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1140"]}
kill_chain	{"phase":["exploit","installation"],"step":[4,5],"attck_tactics":["TA0002","TA0004","TA0005"],"attck_techniques":["T1211","T1218","T1562.001","T1562.004","T1562.006","T1003.001","T1068","T1620","T1112"]}
depends_on	["exploit-development","reverse-engineering"]
feeds_into	["shellcode-dev","edr-evasion","windows-boundaries"]
inputs	["mitigation_config","binary_analysis","target_os_build"]
outputs	["bypass_technique","finding_record","mitigation_fingerprint"]
references	["references/memory-safety-mitigations.md","references/acg-cig-dynamic-code.md","references/wdac-app-control-bypass.md","references/asr-amsi-etw-blinding.md","references/ppl-lsa-protection.md","references/byovd-vbs-hvci.md"]
scripts	["scripts/mitigation_recon.ps1","scripts/Get-ProcessMitigationMap.ps1","scripts/find_nonaslr_modules.py","scripts/cfg_dispatch_gadget_finder.py","scripts/extract_asr_exclusions.py","scripts/check_driver_blocklist.py"]

Windows Mitigations & Bypass

Defeating both exploit mitigations (ASLR/DEP/CFG/XFG/CET/ACG) and platform security controls (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement.

When to Activate

• Fingerprinting a target's mitigation landscape before weaponizing an exploit
• Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain
• Bypassing application control (WDAC / App Control for Business) to run unsigned code
• Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation
• Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR
• Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state

Technique Map

Technique	ATT&CK	CWE	Reference	Script
ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module)	T1211	CWE-330	references/memory-safety-mitigations.md	scripts/find_nonaslr_modules.py
DEP/NX bypass (ROP→VirtualProtect, ret2libc)	T1211	CWE-119	references/memory-safety-mitigations.md	scripts/cfg_dispatch_gadget_finder.py
CFG/XFG bypass (valid-target dispatch gadget, type-hash collision)	T1211	CWE-1240	references/memory-safety-mitigations.md	scripts/cfg_dispatch_gadget_finder.py
CET shadow stack / IBT evasion (non-CET process, JOP, exception unwind)	T1211	CWE-1419	references/memory-safety-mitigations.md	scripts/Get-ProcessMitigationMap.ps1
ACG/CIG bypass (signed-code reuse, JIT exemption, cross-process)	T1211, T1055	CWE-94	references/acg-cig-dynamic-code.md	scripts/Get-ProcessMitigationMap.ps1
WDAC / App Control bypass (LOLBin, signed Electron/V8, sideload)	T1218	CWE-693	references/wdac-app-control-bypass.md	scripts/mitigation_recon.ps1
ASR rule bypass (excluded path/process hollow, COM, syscalls)	T1562.001	CWE-693	references/asr-amsi-etw-blinding.md	scripts/extract_asr_exclusions.py