Options used to control Introcore behavior. More...

Macros
#define	INTRO_OPT_PROT_KM_NT 0x0000000000000001ull
	Enable kernel image protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_LX 0x0000000000000001ull
	Enable kernel image protection (Linux only). More...

#define	INTRO_OPT_PROT_KM_HAL 0x0000000000000002ull
	Enable HAL protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_SSDT 0x0000000000000004ull
	Enable SSDT protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_IDT 0x0000000000000008ull

#define	INTRO_OPT_PROT_KM_HAL_DISP_TABLE 0x0000000000000010ull
	Enable HDT (Hal Dispatch Table) protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_SYSTEM_CR3 0x0000000000000020ull
	Enable System process PDBR protection. More...

#define	INTRO_OPT_PROT_KM_TOKEN_PTR 0x0000000000000040ull
	Enable process token protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_CREDS 0x0000000000000040ull

#define	INTRO_OPT_PROT_KM_NT_DRIVERS 0x0000000000000080ull
	Enable core NT drivers protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_LX_MODULES 0x0000000000000080ull
	Enable Linux kernel modules protection (Linux only). More...

#define	INTRO_OPT_PROT_KM_AV_DRIVERS 0x0000000000000100ull
	Enable AV drivers protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_XEN_DRIVERS 0x0000000000000200ull

#define	INTRO_OPT_PROT_KM_DRVOBJ 0x0000000000000400ull
	Enable driver object & fast I/O dispatch protection. More...

#define	INTRO_OPT_PROT_KM_CR4 0x0000000000000800ull
	Enable CR4.SMEP and CR4.SMAP protection. More...

#define	INTRO_OPT_PROT_KM_MSR_SYSCALL 0x0000000000001000ull

#define	INTRO_OPT_PROT_KM_IDTR 0x0000000000002000ull
	Enable interrupt descriptor-table registers protection. More...

#define	INTRO_OPT_PROT_KM_HAL_HEAP_EXEC 0x0000000000004000ull
	Enable execution prevention on the Hal Heap when it is not ASLR'd (Windows only). More...

#define	INTRO_OPT_PROT_KM_HAL_INT_CTRL 0x0000000000008000ull
	Enable Hal Interrupt Controller write protection. More...

#define	INTRO_OPT_PROT_UM_MISC_PROCS 0x0000000000010000ull

#define	INTRO_OPT_PROT_UM_SYS_PROCS 0x0000000000020000ull
	Enable user-mode system processes protection (injection only). More...

#define	INTRO_OPT_PROT_KM_SELF_MAP_ENTRY 0x0000000000040000ull

#define	INTRO_OPT_PROT_KM_GDTR 0x0000000000080000ull
	Enable global descriptor-table registers protection. More...

#define	INTRO_OPT_EVENT_PROCESSES 0x0000000000100000ull
	Enable process creation and termination events (generates introEventProcessEvent events). More...

#define	INTRO_OPT_EVENT_MODULES 0x0000000000200000ull
	Enable user mode and kernel mode module load and unload events (generates introEventModuleEvent events). More...

#define	INTRO_OPT_EVENT_OS_CRASH 0x0000000000400000ull
	Enable OS crash events (generates introEventCrashEvent events). More...

#define	INTRO_OPT_EVENT_PROCESS_CRASH 0x0000000000800000ull
	Enable application crash events (generates introEventExceptionEvent). More...

#define	INTRO_OPT_AGENT_INJECTION 0x0000000001000000ull
	Enable agent injections. More...

#define	INTRO_OPT_FULL_PATH 0x0000000002000000ull
	Enable full-path protection of processes. More...

#define	INTRO_OPT_KM_BETA_DETECTIONS 0x0000000004000000ull

#define	INTRO_OPT_NOTIFY_ENGINES 0x0000000008000000ull
	Send suspicious pages to be scanned by third party scan engines. More...

#define	INTRO_OPT_IN_GUEST_PT_FILTER 0x0000000010000000ull
	Enable in-guest page-table filtering (64-bit Windows only). More...

#define	INTRO_OPT_BUGCHECK_CLEANUP 0x0000000020000000ull
	Enable memory cleanup after an OS crash (Windows). More...

#define	INTRO_OPT_PANIC_CLEANUP 0x0000000020000000ull
	Enable memory cleanup after an OS crash (Linux). More...

#define	INTRO_OPT_SYSPROC_BETA_DETECTIONS 0x0000000040000000ull
	Enable system processes beta (log only) detection. More...

#define	INTRO_OPT_VE 0x0000000080000000ull
	Enable the Virtualization exception page table access pre-filtering agent (64-bit Windows only). More...

#define	INTRO_OPT_EVENT_CONNECTIONS 0x0000000100000000ull
	Enable connection events. More...

#define	INTRO_OPT_PROT_KM_LOGGER_CONTEXT 0x0000000200000000ull
	Enable protection on WMI_LOGGER_CONTEXT.GetCpuClock used by InfinityHook (Windows only). More...

#define	INTRO_OPT_PROT_DPI_DEBUG 0x0000000400000000ull
	Enable process creation protection for child processes created with debug flag. More...

#define	INTRO_OPT_PROT_DPI_STACK_PIVOT 0x0000000800000000ull
	Enable process creation protection for pivoted stack. More...

#define	INTRO_OPT_PROT_DPI_TOKEN_STEAL 0x0000001000000000ull
	Enable process creation protection for stolen token. More...

#define	INTRO_OPT_PROT_DPI_HEAP_SPRAY 0x0000002000000000ull
	Enable process creation protection for heap sprayed parent. More...

#define	INTRO_OPT_PROT_KM_NT_EAT_READS 0x0000004000000000ull
	Enable kernel EAT read protection (Windows only). More...

#define	INTRO_OPT_PROT_KM_LX_TEXT_READS 0x0000008000000000ull
	Enable kernel '_text' section read protection (Linux only). More...

#define	INTRO_OPT_PROT_KM_VDSO 0x0000010000000000ull
	Enable vDSO image protection (Linux only). More...

#define	INTRO_OPT_PROT_KM_SWAPGS 0x0000020000000000ull
	Enable SWAPGS (CVE-2019-1125) mitigation. More...

#define	INTRO_OPT_PROT_KM_TOKEN_PRIVS 0x0000040000000000ull
	Enable protection over Token Privileges bitmaps. More...

#define	INTRO_OPT_PROT_DPI_TOKEN_PRIVS 0x0000080000000000ull
	Enable process creation protection for parent which has violated Token privileges constraints. More...

#define	INTRO_OPT_PROT_DPI_THREAD_SHELL 0x0000100000000000ull
	Examines the code where the current thread started execution when the current thread creates a process. More...

#define	INTRO_OPT_PROT_KM_SUD_EXEC 0x0000200000000000ull
	Enable protection against executions on SharedUserData. More...

#define	INTRO_OPT_PROT_KM_HAL_PERF_CNT 0x0000400000000000ull
	Enable protection over HalPerformanceCounter's function pointer, which is called inside KeQueryPerformanceCounter. More...

#define	INTRO_OPT_PROT_KM_SD_ACL 0x0000800000000000ull
	Enable integrity protection over the Security Descriptor pointer and the 2 ACLs (SACL/DACL). More...

#define	INTRO_OPT_PROT_DPI_SD_ACL 0x0001000000000000ull
	Enable detection of Security Descriptor pointer modifications and ACL modifications on process creation. More...

#define	INTRO_OPT_PROT_KM_SUD_INTEGRITY 0x0002000000000000ull
	Enable integrity checks over various SharedUserData fields, as well as the zero-filled zone after the SharedUserData structure. More...

#define	INTRO_OPT_PROT_KM_INTERRUPT_OBJ 0x0004000000000000ull
	Enable protection against modifications of interrupt objects from KPRCB's InterruptObject. More...

#define	INTRO_OPT_PROT_DPI
	Aggregates all the deep process inspection flags. More...

#define	INTRO_OPT_ENABLE_KM_PROTECTION
	Aggregates all the kernel mode protection flags. More...

#define	INTRO_OPT_ENABLE_UM_PROTECTION
	Aggregates all the user mode protection flags. More...

#define	INTRO_OPT_ENABLE_AV_PROTECTION (INTRO_OPT_PROT_KM_AV_DRIVERS)
	Aggregates all the AV protection flags. More...

#define	INTRO_OPT_ENABLE_CR_PROTECTION (INTRO_OPT_PROT_KM_CR4)
	Aggregates all the control register protection flags. More...

#define	INTRO_OPT_ENABLE_MSR_PROTECTION (INTRO_OPT_PROT_KM_MSR_SYSCALL)
	Aggregates all the MSR protection flags. More...

#define	INTRO_OPT_ENABLE_INTEGRITY_CHECKS
	Aggregates all the integrity protection flags. More...

#define	INTRO_OPT_ENABLE_DTR_PROTECTION
	Aggregates all the descriptor table register protection flags. More...

#define	INTRO_OPT_ENABLE_KM_BETA_DETECTIONS (INTRO_OPT_KM_BETA_DETECTIONS)
	Aggregates all the kernel log-only detection flags. More...

#define	INTRO_OPT_ENABLE_FULL_PATH (INTRO_OPT_FULL_PATH)
	Aggregates all the full path protection flags. More...

#define	INTRO_OPT_ENABLE_XEN_PROTECTION (INTRO_OPT_PROT_KM_XEN_DRIVERS)
	Aggregates all the XEN-related protection flags. More...

#define	INTRO_OPT_ENABLE_MANUAL_AGENT_INJ (INTRO_OPT_AGENT_INJECTION)
	Aggregates all the agent injection flags. More...

#define	INTRO_OPT_ENABLE_MISC_EVENTS
	Aggregates all the miscellaneous protection flags. More...

#define	INTRO_OPT_DYNAMIC_OPTIONS_MASK (0xffffffffffffffff)
	All the flags that can be modified without unloading Introcore. More...

#define	INTRO_OPT_DEFAULT_OPTIONS
	Aggregates all the default options. More...

#define	INTRO_OPT_DEFAULT_XEN_OPTIONS
	Aggregates all the default XEN options. More...

#define	INTRO_OPT_ONLY_KERNEL
	Aggregates all the kernel-only protection and activation flags. More...

#define	POLICY_KM_BETA_FLAGS
	Aggregates all the flags that are affected by the INTRO_OPT_ENABLE_KM_BETA_DETECTIONS flag. More...

Detailed Description

Options used to control Introcore behavior.

Macro Definition Documentation

◆ INTRO_OPT_AGENT_INJECTION

#define INTRO_OPT_AGENT_INJECTION 0x0000000001000000ull

Enable agent injections.

Definition at line 451 of file intro_types.h.

Referenced by IntInjectFileAgentInGuest(), and IntInjectProcessAgentInGuest().

◆ INTRO_OPT_BUGCHECK_CLEANUP

#define INTRO_OPT_BUGCHECK_CLEANUP 0x0000000020000000ull

Enable memory cleanup after an OS crash (Windows).

When this flag is set, introcore will try to remove all the code it modified inside the guest.

Definition at line 466 of file intro_types.h.

Referenced by IntGuestUninitOnBugcheck().

◆ INTRO_OPT_DEFAULT_OPTIONS

#define INTRO_OPT_DEFAULT_OPTIONS

Value:

(INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_UM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_CR_PROTECTION         |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_KM_BETA_DETECTIONS    |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

Aggregates all the default options.

Definition at line 612 of file intro_types.h.

◆ INTRO_OPT_DEFAULT_XEN_OPTIONS

#define INTRO_OPT_DEFAULT_XEN_OPTIONS

Value:

(INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_UM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_CR_PROTECTION         |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_ENABLE_MANUAL_AGENT_INJ      |\
                                             INTRO_OPT_ENABLE_MISC_EVENTS           |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

Aggregates all the default XEN options.

Definition at line 625 of file intro_types.h.

◆ INTRO_OPT_DYNAMIC_OPTIONS_MASK

#define INTRO_OPT_DYNAMIC_OPTIONS_MASK (0xffffffffffffffff)

All the flags that can be modified without unloading Introcore.

Definition at line 609 of file intro_types.h.

◆ INTRO_OPT_ENABLE_AV_PROTECTION

#define INTRO_OPT_ENABLE_AV_PROTECTION (INTRO_OPT_PROT_KM_AV_DRIVERS)

Aggregates all the AV protection flags.

Definition at line 566 of file intro_types.h.

◆ INTRO_OPT_ENABLE_CR_PROTECTION

#define INTRO_OPT_ENABLE_CR_PROTECTION (INTRO_OPT_PROT_KM_CR4)

Aggregates all the control register protection flags.

Definition at line 569 of file intro_types.h.

◆ INTRO_OPT_ENABLE_DTR_PROTECTION

#define INTRO_OPT_ENABLE_DTR_PROTECTION

Value:

(INTRO_OPT_PROT_KM_IDTR | \

INTRO_OPT_PROT_KM_GDTR)

INTRO_OPT_PROT_KM_IDTR

#define INTRO_OPT_PROT_KM_IDTR

Enable interrupt descriptor-table registers protection.

Definition: intro_types.h:429

Aggregates all the descriptor table register protection flags.

Definition at line 587 of file intro_types.h.

◆ INTRO_OPT_ENABLE_FULL_PATH

#define INTRO_OPT_ENABLE_FULL_PATH (INTRO_OPT_FULL_PATH)

Aggregates all the full path protection flags.

Definition at line 594 of file intro_types.h.

Referenced by IntWinProcChangeProtectionFlags().

◆ INTRO_OPT_ENABLE_INTEGRITY_CHECKS

#define INTRO_OPT_ENABLE_INTEGRITY_CHECKS

Value:

(INTRO_OPT_PROT_KM_IDT              | \
                                            INTRO_OPT_PROT_KM_HAL_DISP_TABLE    | \
                                            INTRO_OPT_PROT_KM_SYSTEM_CR3        | \
                                            INTRO_OPT_PROT_KM_TOKEN_PTR         | \
                                            INTRO_OPT_PROT_KM_CREDS             | \
                                            INTRO_OPT_PROT_KM_LOGGER_CONTEXT    | \
                                            INTRO_OPT_PROT_KM_TOKEN_PRIVS       | \
                                            INTRO_OPT_PROT_KM_SD_ACL            | \
                                            INTRO_OPT_PROT_KM_SUD_INTEGRITY     | \
                                            INTRO_OPT_PROT_KM_INTERRUPT_OBJ)

Aggregates all the integrity protection flags.

Definition at line 575 of file intro_types.h.

◆ INTRO_OPT_ENABLE_KM_BETA_DETECTIONS

#define INTRO_OPT_ENABLE_KM_BETA_DETECTIONS (INTRO_OPT_KM_BETA_DETECTIONS)

Aggregates all the kernel log-only detection flags.

Definition at line 591 of file intro_types.h.

Referenced by IntNewGuestNotification().

◆ INTRO_OPT_ENABLE_KM_PROTECTION

#define INTRO_OPT_ENABLE_KM_PROTECTION

Value:

(INTRO_OPT_PROT_KM_NT           | \
                                            INTRO_OPT_PROT_KM_LX            | \
                                            INTRO_OPT_PROT_KM_HAL           | \
                                            INTRO_OPT_PROT_KM_SSDT          | \
                                            INTRO_OPT_PROT_KM_VDSO          | \
                                            INTRO_OPT_PROT_KM_NT_DRIVERS    | \
                                            INTRO_OPT_PROT_KM_LX_MODULES    | \
                                            INTRO_OPT_PROT_KM_NT_EAT_READS  | \
                                            INTRO_OPT_PROT_KM_DRVOBJ        | \
                                            INTRO_OPT_PROT_KM_HAL_HEAP_EXEC | \
                                            INTRO_OPT_PROT_KM_HAL_INT_CTRL  | \
                                            INTRO_OPT_PROT_KM_SELF_MAP_ENTRY| \
                                            INTRO_OPT_PROT_KM_SWAPGS        | \
                                            INTRO_OPT_PROT_KM_SUD_EXEC      | \
                                            INTRO_OPT_PROT_KM_HAL_PERF_CNT)

Aggregates all the kernel mode protection flags.

Definition at line 544 of file intro_types.h.

◆ INTRO_OPT_ENABLE_MANUAL_AGENT_INJ

#define INTRO_OPT_ENABLE_MANUAL_AGENT_INJ (INTRO_OPT_AGENT_INJECTION)

Aggregates all the agent injection flags.

Definition at line 600 of file intro_types.h.

◆ INTRO_OPT_ENABLE_MISC_EVENTS

#define INTRO_OPT_ENABLE_MISC_EVENTS

Value:

(INTRO_OPT_EVENT_PROCESSES  | \
                                            INTRO_OPT_EVENT_MODULES     | \
                                            INTRO_OPT_EVENT_OS_CRASH    | \
                                            INTRO_OPT_EVENT_PROCESS_CRASH)

Aggregates all the miscellaneous protection flags.

Definition at line 603 of file intro_types.h.

◆ INTRO_OPT_ENABLE_MSR_PROTECTION

#define INTRO_OPT_ENABLE_MSR_PROTECTION (INTRO_OPT_PROT_KM_MSR_SYSCALL)

Aggregates all the MSR protection flags.

Definition at line 572 of file intro_types.h.

◆ INTRO_OPT_ENABLE_UM_PROTECTION

#define INTRO_OPT_ENABLE_UM_PROTECTION

Value:

(INTRO_OPT_PROT_UM_MISC_PROCS   | \
                                            INTRO_OPT_PROT_UM_SYS_PROCS     | \
                                            INTRO_OPT_PROT_DPI)

Aggregates all the user mode protection flags.

Definition at line 561 of file intro_types.h.

Referenced by IntWinProcAddProtectedProcess(), IntWinProcCreateProcessObject(), and IntWinProcHandleCopyMemory().

◆ INTRO_OPT_ENABLE_XEN_PROTECTION

#define INTRO_OPT_ENABLE_XEN_PROTECTION (INTRO_OPT_PROT_KM_XEN_DRIVERS)

Aggregates all the XEN-related protection flags.

Definition at line 597 of file intro_types.h.

◆ INTRO_OPT_EVENT_CONNECTIONS

#define INTRO_OPT_EVENT_CONNECTIONS 0x0000000100000000ull

Enable connection events.

Ignored for processes that do not have the PROC_OPT_PROT_EXPLOIT protection flag. Will send one introEventConnectionEvent for each connection opened by a process when an introEventEptViolation event is triggered for an execution attempt.

Definition at line 482 of file intro_types.h.

Referenced by IntLixNetIterateTaskConnections(), IntLixNetSendGuestConnections(), and IntWinNetSendProcessConnections().

◆ INTRO_OPT_EVENT_MODULES

#define INTRO_OPT_EVENT_MODULES 0x0000000000200000ull

Enable user mode and kernel mode module load and unload events (generates introEventModuleEvent events).

Definition at line 445 of file intro_types.h.

Referenced by IntLixDrvSendEvent(), IntWinDrvSendEvent(), and IntWinProcSendDllEvent().

◆ INTRO_OPT_EVENT_OS_CRASH

#define INTRO_OPT_EVENT_OS_CRASH 0x0000000000400000ull

Enable OS crash events (generates introEventCrashEvent events).

Definition at line 447 of file intro_types.h.

Referenced by IntWinBcSendBsodEvent().

◆ INTRO_OPT_EVENT_PROCESS_CRASH

#define INTRO_OPT_EVENT_PROCESS_CRASH 0x0000000000800000ull

Enable application crash events (generates introEventExceptionEvent).

Definition at line 449 of file intro_types.h.

Referenced by IntLixTaskSendExceptionEvent(), and IntWinProcSendProcessExceptionEvent().

◆ INTRO_OPT_EVENT_PROCESSES

#define INTRO_OPT_EVENT_PROCESSES 0x0000000000100000ull

Enable process creation and termination events (generates introEventProcessEvent events).

Definition at line 443 of file intro_types.h.

Referenced by IntLixTaskSendTaskEvent(), and IntWinProcSendProcessEvent().

◆ INTRO_OPT_FULL_PATH

#define INTRO_OPT_FULL_PATH 0x0000000002000000ull

Enable full-path protection of processes.

If set, the full path of the main module of the process must match the full path provided at protection time.

Definition at line 456 of file intro_types.h.

Referenced by IntWinProcGetProtectedInfoEx().

◆ INTRO_OPT_IN_GUEST_PT_FILTER

#define INTRO_OPT_IN_GUEST_PT_FILTER 0x0000000010000000ull

Enable in-guest page-table filtering (64-bit Windows only).

Definition at line 461 of file intro_types.h.

Referenced by IntGuestInit(), IntGuestUpdateCoreOptions(), IntHandleTimer(), IntPtiHandleGuestResumeFromSleep(), IntVeCompleteLoader(), IntWinPowHandleEventCommon(), and IntWinProcCreateProcessObject().

◆ INTRO_OPT_KM_BETA_DETECTIONS

#define INTRO_OPT_KM_BETA_DETECTIONS 0x0000000004000000ull

Enable kernel beta (log only) detections.

Definition at line 457 of file intro_types.h.

Referenced by IntGuestInit(), and IntGuestUpdateCoreOptions().

◆ INTRO_OPT_NOTIFY_ENGINES

#define INTRO_OPT_NOTIFY_ENGINES 0x0000000008000000ull

Send suspicious pages to be scanned by third party scan engines.

Definition at line 459 of file intro_types.h.

Referenced by IntLixVmaHandlePageExecution(), and IntWinVadIsExecSuspicious().

◆ INTRO_OPT_ONLY_KERNEL

#define INTRO_OPT_ONLY_KERNEL

Value:

(INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_KM_BETA_DETECTIONS    |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

Aggregates all the kernel-only protection and activation flags.

Definition at line 639 of file intro_types.h.

◆ INTRO_OPT_PANIC_CLEANUP

#define INTRO_OPT_PANIC_CLEANUP 0x0000000020000000ull

Enable memory cleanup after an OS crash (Linux).

When this flag is set, introcore will try to remove all the code it modified inside the guest.

Definition at line 470 of file intro_types.h.

◆ INTRO_OPT_PROT_DPI

#define INTRO_OPT_PROT_DPI

Value:

(INTRO_OPT_PROT_DPI_DEBUG       | \
                                            INTRO_OPT_PROT_DPI_STACK_PIVOT  | \
                                            INTRO_OPT_PROT_DPI_TOKEN_STEAL  | \
                                            INTRO_OPT_PROT_DPI_HEAP_SPRAY   | \
                                            INTRO_OPT_PROT_DPI_TOKEN_PRIVS  | \
                                            INTRO_OPT_PROT_DPI_THREAD_SHELL | \
                                            INTRO_OPT_PROT_DPI_SD_ACL)

Aggregates all the deep process inspection flags.

Definition at line 534 of file intro_types.h.

Referenced by IntLixTaskHandleExec(), IntLixValidateProcessCreationRights(), and IntWinDpiCheckCreation().

◆ INTRO_OPT_PROT_DPI_DEBUG

#define INTRO_OPT_PROT_DPI_DEBUG 0x0000000400000000ull

Enable process creation protection for child processes created with debug flag.

Definition at line 488 of file intro_types.h.

Referenced by IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiDebug().

◆ INTRO_OPT_PROT_DPI_HEAP_SPRAY

#define INTRO_OPT_PROT_DPI_HEAP_SPRAY 0x0000002000000000ull

Enable process creation protection for heap sprayed parent.

Definition at line 494 of file intro_types.h.

Referenced by IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiHeapSpray().

◆ INTRO_OPT_PROT_DPI_SD_ACL

#define INTRO_OPT_PROT_DPI_SD_ACL 0x0001000000000000ull

Enable detection of Security Descriptor pointer modifications and ACL modifications on process creation.

Definition at line 524 of file intro_types.h.

Referenced by IntWinDpiGatherDpiInfo(), IntWinDpiHandleDpiAclEdit(), and IntWinDpiHandleDpiSecDesc().

◆ INTRO_OPT_PROT_DPI_STACK_PIVOT

#define INTRO_OPT_PROT_DPI_STACK_PIVOT 0x0000000800000000ull

Enable process creation protection for pivoted stack.

Definition at line 490 of file intro_types.h.

Referenced by IntLixTaskHandleExec(), IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiPivotedStack().

◆ INTRO_OPT_PROT_DPI_THREAD_SHELL

#define INTRO_OPT_PROT_DPI_THREAD_SHELL 0x0000100000000000ull

Examines the code where the current thread started execution when the current thread creates a process.

Definition at line 509 of file intro_types.h.

Referenced by IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiThreadStart().

◆ INTRO_OPT_PROT_DPI_TOKEN_PRIVS

#define INTRO_OPT_PROT_DPI_TOKEN_PRIVS 0x0000080000000000ull

Enable process creation protection for parent which has violated Token privileges constraints.

Definition at line 507 of file intro_types.h.

Referenced by IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiTokenPrivs().

◆ INTRO_OPT_PROT_DPI_TOKEN_STEAL

#define INTRO_OPT_PROT_DPI_TOKEN_STEAL 0x0000001000000000ull

Enable process creation protection for stolen token.

Definition at line 492 of file intro_types.h.

Referenced by IntLixCredsVerify(), IntWinDpiGatherDpiInfo(), and IntWinDpiHandleDpiStolenToken().

◆ INTRO_OPT_PROT_KM_AV_DRIVERS

#define INTRO_OPT_PROT_KM_AV_DRIVERS 0x0000000000000100ull

Enable AV drivers protection (Windows only).

Definition at line 422 of file intro_types.h.

Referenced by IntWinDrvIsProtected().

◆ INTRO_OPT_PROT_KM_CR4

#define INTRO_OPT_PROT_KM_CR4 0x0000000000000800ull

Enable CR4.SMEP and CR4.SMAP protection.

Definition at line 426 of file intro_types.h.

Referenced by IntCrLixHandleWrite(), IntCrSendAlert(), IntCrWinHandleWrite(), IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), and IntWinGuestActivateProtection().

◆ INTRO_OPT_PROT_KM_CREDS

#define INTRO_OPT_PROT_KM_CREDS 0x0000000000000040ull

Enable 'struct creds' protection (Linux only).

Definition at line 417 of file intro_types.h.

Referenced by IntLixCredAdd(), IntLixCredCheckIntegrity(), and IntLixCredsVerify().

◆ INTRO_OPT_PROT_KM_DRVOBJ

#define INTRO_OPT_PROT_KM_DRVOBJ 0x0000000000000400ull

Enable driver object & fast I/O dispatch protection.

Definition at line 425 of file intro_types.h.

Referenced by IntWinDrvObjHandleModification(), IntWinDrvObjHandleWrite(), IntWinDrvObjIsProtected(), IntWinDrvObjSendEptAlert(), and IntWinDrvObjSendIntegrityAlert().

◆ INTRO_OPT_PROT_KM_GDTR

#define INTRO_OPT_PROT_KM_GDTR 0x0000000000080000ull

Enable global descriptor-table registers protection.

Definition at line 440 of file intro_types.h.

Referenced by IntDtrGetProtOption(), IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), and IntWinGuestActivateProtection().

◆ INTRO_OPT_PROT_KM_HAL

#define INTRO_OPT_PROT_KM_HAL 0x0000000000000002ull

Enable HAL protection (Windows only).

Definition at line 410 of file intro_types.h.

Referenced by IntWinDrvIsProtected().

◆ INTRO_OPT_PROT_KM_HAL_DISP_TABLE

#define INTRO_OPT_PROT_KM_HAL_DISP_TABLE 0x0000000000000010ull

Enable HDT (Hal Dispatch Table) protection (Windows only).

Definition at line 414 of file intro_types.h.

Referenced by IntWinHalCreateHalData(), IntWinHalHandleDispatchTableWrite(), and IntWinHalUpdateProtection().

◆ INTRO_OPT_PROT_KM_HAL_HEAP_EXEC

#define INTRO_OPT_PROT_KM_HAL_HEAP_EXEC 0x0000000000004000ull

Enable execution prevention on the Hal Heap when it is not ASLR'd (Windows only).

Definition at line 431 of file intro_types.h.

Referenced by IntWinHalCreateHalData(), IntWinHalHandleHalHeapExec(), and IntWinHalUpdateProtection().

◆ INTRO_OPT_PROT_KM_HAL_INT_CTRL

#define INTRO_OPT_PROT_KM_HAL_INT_CTRL 0x0000000000008000ull

Enable Hal Interrupt Controller write protection.

Definition at line 433 of file intro_types.h.

Referenced by IntWinHalCreateHalData(), IntWinHalHandleHalIntCtrlWrite(), IntWinHalSendAlert(), and IntWinHalUpdateProtection().

◆ INTRO_OPT_PROT_KM_HAL_PERF_CNT

#define INTRO_OPT_PROT_KM_HAL_PERF_CNT 0x0000400000000000ull

Enable protection over HalPerformanceCounter's function pointer, which is called inside KeQueryPerformanceCounter.

Definition at line 519 of file intro_types.h.

Referenced by IntWinHalFindPerformanceCounterInternal(), IntWinHalHandlePerfCounterModification(), IntWinHalSendPerfCntIntegrityAlert(), and IntWinHalUpdateProtection().

◆ INTRO_OPT_PROT_KM_IDT

#define INTRO_OPT_PROT_KM_IDT 0x0000000000000008ull

Enable IDT protection.

Definition at line 412 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), IntLixIdtWriteHandler(), IntWinGuestActivateProtection(), IntWinIdtHandleModification(), IntWinIdtSendIntegrityAlert(), and IntWinIdtWriteHandler().

◆ INTRO_OPT_PROT_KM_IDTR

#define INTRO_OPT_PROT_KM_IDTR 0x0000000000002000ull

Enable interrupt descriptor-table registers protection.

Definition at line 429 of file intro_types.h.

Referenced by IntDtrGetProtOption(), IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), and IntWinGuestActivateProtection().

◆ INTRO_OPT_PROT_KM_INTERRUPT_OBJ

#define INTRO_OPT_PROT_KM_INTERRUPT_OBJ 0x0004000000000000ull

Enable protection against modifications of interrupt objects from KPRCB's InterruptObject.

Definition at line 531 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinGuestActivateProtection(), IntWinIntObjHandleModification(), and IntWinIntObjSendIntegrityAlert().

◆ INTRO_OPT_PROT_KM_LOGGER_CONTEXT

#define INTRO_OPT_PROT_KM_LOGGER_CONTEXT 0x0000000200000000ull

Enable protection on WMI_LOGGER_CONTEXT.GetCpuClock used by InfinityHook (Windows only).

Definition at line 485 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinInfHookEptSppHandleWrite(), IntWinInfHookEptSppSendAlert(), IntWinInfHookIntegrityHandleWrite(), IntWinInfHookIntegritySendAlert(), and IntWinInfHookProtect().

◆ INTRO_OPT_PROT_KM_LX

#define INTRO_OPT_PROT_KM_LX 0x0000000000000001ull

Enable kernel image protection (Linux only).

Definition at line 409 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), IntLixHookKernelWrite(), IntLixKernelReadUnprotect(), and IntLixKernelWriteUnprotect().

◆ INTRO_OPT_PROT_KM_LX_MODULES

#define INTRO_OPT_PROT_KM_LX_MODULES 0x0000000000000080ull

Enable Linux kernel modules protection (Linux only).

Definition at line 421 of file intro_types.h.

Referenced by IntLixDrvActivateProtection(), and IntLixDrvUpdateProtection().

◆ INTRO_OPT_PROT_KM_LX_TEXT_READS

#define INTRO_OPT_PROT_KM_LX_TEXT_READS 0x0000008000000000ull

Enable kernel '_text' section read protection (Linux only).

Definition at line 499 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), IntLixHookKernelRead(), IntLixKernelReadUnprotect(), and IntLixKernelWriteUnprotect().

◆ INTRO_OPT_PROT_KM_MSR_SYSCALL

#define INTRO_OPT_PROT_KM_MSR_SYSCALL 0x0000000000001000ull

Enable SYSCALL/SYSENTER MSR protection.

Definition at line 427 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), IntLixMsrHandleWrite(), IntWinGuestActivateProtection(), IntWinMsrHandleWrite(), and IntWinMsrSendAlert().

◆ INTRO_OPT_PROT_KM_NT

#define INTRO_OPT_PROT_KM_NT 0x0000000000000001ull

Enable kernel image protection (Windows only).

Definition at line 408 of file intro_types.h.

Referenced by IntExceptGetVictimEpt(), and IntWinDrvIsProtected().

◆ INTRO_OPT_PROT_KM_NT_DRIVERS

#define INTRO_OPT_PROT_KM_NT_DRIVERS 0x0000000000000080ull

Enable core NT drivers protection (Windows only).

Definition at line 419 of file intro_types.h.

Referenced by IntWinDrvIsProtected().

◆ INTRO_OPT_PROT_KM_NT_EAT_READS

#define INTRO_OPT_PROT_KM_NT_EAT_READS 0x0000004000000000ull

Enable kernel EAT read protection (Windows only).

Definition at line 497 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinDrvForceDisableReadNtEat(), and IntWinDrvHeadersInMemory().

◆ INTRO_OPT_PROT_KM_SD_ACL

#define INTRO_OPT_PROT_KM_SD_ACL 0x0000800000000000ull

Enable integrity protection over the Security Descriptor pointer and the 2 ACLs (SACL/DACL).

Definition at line 522 of file intro_types.h.

Referenced by IntWinSDCheckIntegrity(), IntWinSDSendAclIntegrityViolation(), and IntWinSDSendSecDescIntViolation().

◆ INTRO_OPT_PROT_KM_SELF_MAP_ENTRY

#define INTRO_OPT_PROT_KM_SELF_MAP_ENTRY 0x0000000000040000ull

Enable self-map entry protection.

Definition at line 438 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinSelfMapGetAndCheckSelfMapEntry(), IntWinSelfMapHandleCr3SelfMapModification(), IntWinSelfMapHandleCr3SelfMapWrite(), IntWinSelfMapProtectSelfMapIndex(), and IntWinSelfMapValidateSelfMapEntries().

◆ INTRO_OPT_PROT_KM_SSDT

#define INTRO_OPT_PROT_KM_SSDT 0x0000000000000004ull

Enable SSDT protection (Windows only).

Definition at line 411 of file intro_types.h.

◆ INTRO_OPT_PROT_KM_SUD_EXEC

#define INTRO_OPT_PROT_KM_SUD_EXEC 0x0000200000000000ull

Enable protection against executions on SharedUserData.

Note that even if the alert can be both for KM or UM, it is a KM policy flag, since there could not be SharedUserData executions without malicious behavior happening in kernel.

Definition at line 515 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinGuestActivateProtection(), IntWinSudHandleKernelSudExec(), IntWinSudHandleUserSudExec(), and IntWinSudSendSudExecAlert().

◆ INTRO_OPT_PROT_KM_SUD_INTEGRITY

#define INTRO_OPT_PROT_KM_SUD_INTEGRITY 0x0002000000000000ull

Enable integrity checks over various SharedUserData fields, as well as the zero-filled zone after the SharedUserData structure.

Definition at line 528 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinGuestActivateProtection(), IntWinSudCheckIntegrity(), IntWinSudHandleFieldModification(), and IntWinSudSendSudIntegrityAlert().

◆ INTRO_OPT_PROT_KM_SWAPGS

#define INTRO_OPT_PROT_KM_SWAPGS 0x0000020000000000ull

Enable SWAPGS (CVE-2019-1125) mitigation.

Definition at line 502 of file intro_types.h.

Referenced by IntLixPatchSwapgs(), and IntSwapgsStartMitigation().

◆ INTRO_OPT_PROT_KM_SYSTEM_CR3

#define INTRO_OPT_PROT_KM_SYSTEM_CR3 0x0000000000000020ull

Enable System process PDBR protection.

Definition at line 415 of file intro_types.h.

Referenced by IntWinProcValidateSystemCr3().

◆ INTRO_OPT_PROT_KM_TOKEN_PRIVS

#define INTRO_OPT_PROT_KM_TOKEN_PRIVS 0x0000040000000000ull

Enable protection over Token Privileges bitmaps.

Definition at line 505 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntWinProcCreateProcessObject(), IntWinProcDeleteProcessObject(), IntWinTokenCheckIntegrity(), IntWinTokenPrivsCheckIntegrityOnProcess(), IntWinTokenPrivsHandleWrite(), IntWinTokenPrivsProtectOnProcess(), IntWinTokenPrivsSendEptAlert(), IntWinTokenPrivsSendIntegrityAlert(), IntWinTokenProtectPrivs(), and IntWinTokenUnprotectPrivs().

◆ INTRO_OPT_PROT_KM_TOKEN_PTR

#define INTRO_OPT_PROT_KM_TOKEN_PTR 0x0000000000000040ull

Enable process token protection (Windows only).

Definition at line 416 of file intro_types.h.

Referenced by IntWinProcCreateProcessObject(), IntWinProcDeleteProcessObject(), and IntWinTokenCheckIntegrity().

◆ INTRO_OPT_PROT_KM_VDSO

#define INTRO_OPT_PROT_KM_VDSO 0x0000010000000000ull

Enable vDSO image protection (Linux only).

Definition at line 500 of file intro_types.h.

Referenced by IntGuestUpdateCoreOptions(), IntLixGuestActivateProtection(), IntLixTaskHandleExec(), and IntLixVdsoHandleWriteCommon().

◆ INTRO_OPT_PROT_KM_XEN_DRIVERS

#define INTRO_OPT_PROT_KM_XEN_DRIVERS 0x0000000000000200ull

Enable Xen drivers protection (Windows only).

Definition at line 423 of file intro_types.h.

Referenced by IntWinDrvIsProtected().

◆ INTRO_OPT_PROT_UM_MISC_PROCS

#define INTRO_OPT_PROT_UM_MISC_PROCS 0x0000000000010000ull

Enable user-mode process protection.

Definition at line 435 of file intro_types.h.

Referenced by IntLixProcGetProtOption(), IntLixTaskActivateProtection(), IntLixTaskAdjustProtections(), IntLixTaskShouldProtect(), IntWinProcGetProtectedInfo(), IntWinProcGetProtectedInfoEx(), and IntWinProcGetProtOption().

◆ INTRO_OPT_PROT_UM_SYS_PROCS

#define INTRO_OPT_PROT_UM_SYS_PROCS 0x0000000000020000ull

Enable user-mode system processes protection (injection only).

Definition at line 437 of file intro_types.h.

Referenced by IntAlertCoreGetFlags(), IntAlertProcGetFlags(), IntWinProcGetProtectedInfo(), IntWinProcGetProtectedInfoEx(), and IntWinProcGetProtOption().

◆ INTRO_OPT_SYSPROC_BETA_DETECTIONS

#define INTRO_OPT_SYSPROC_BETA_DETECTIONS 0x0000000040000000ull

Enable system processes beta (log only) detection.

Definition at line 472 of file intro_types.h.

Referenced by IntGuestInit(), and IntGuestUpdateCoreOptions().

◆ INTRO_OPT_VE

#define INTRO_OPT_VE 0x0000000080000000ull

Enable the Virtualization exception page table access pre-filtering agent (64-bit Windows only).

Definition at line 475 of file intro_types.h.

Referenced by IntGuestInit(), IntGuestUpdateCoreOptions(), IntHandleTimer(), IntVeCompleteLoader(), IntVeDumpStats(), IntVeHandleGuestResumeFromSleep(), IntVeInit(), IntWinGuestFinishInit(), and IntWinPowHandleEventCommon().

◆ POLICY_KM_BETA_FLAGS

#define POLICY_KM_BETA_FLAGS

Value:

(INTRO_OPT_PROT_KM_NT | INTRO_OPT_PROT_KM_HAL | INTRO_OPT_PROT_KM_SSDT | INTRO_OPT_PROT_KM_IDT                  \
     | INTRO_OPT_PROT_KM_HAL_DISP_TABLE | INTRO_OPT_PROT_KM_SYSTEM_CR3 | INTRO_OPT_PROT_KM_TOKEN_PTR                \
     | INTRO_OPT_PROT_KM_NT_DRIVERS | INTRO_OPT_PROT_KM_AV_DRIVERS | INTRO_OPT_PROT_KM_XEN_DRIVERS                  \
     | INTRO_OPT_PROT_KM_DRVOBJ | INTRO_OPT_PROT_KM_CR4 | INTRO_OPT_PROT_KM_MSR_SYSCALL | INTRO_OPT_PROT_KM_IDTR    \
     | INTRO_OPT_PROT_KM_HAL_HEAP_EXEC | INTRO_OPT_PROT_KM_HAL_INT_CTRL | INTRO_OPT_PROT_KM_SELF_MAP_ENTRY          \
     | INTRO_OPT_PROT_KM_GDTR | INTRO_OPT_PROT_KM_LX | INTRO_OPT_PROT_KM_VDSO | INTRO_OPT_PROT_KM_LX_MODULES        \
     | INTRO_OPT_PROT_KM_CREDS | INTRO_OPT_PROT_KM_TOKEN_PRIVS | INTRO_OPT_PROT_KM_SUD_EXEC                         \
     | INTRO_OPT_PROT_KM_LOGGER_CONTEXT | INTRO_OPT_PROT_KM_NT_EAT_READS | INTRO_OPT_PROT_KM_HAL_PERF_CNT           \
     | INTRO_OPT_PROT_KM_SD_ACL | INTRO_OPT_PROT_KM_SUD_INTEGRITY | INTRO_OPT_PROT_KM_INTERRUPT_OBJ)

Aggregates all the flags that are affected by the INTRO_OPT_ENABLE_KM_BETA_DETECTIONS flag.

Definition at line 650 of file intro_types.h.

Referenced by IntPolicyCoreIsOptionBeta().

Macros

Detailed Description

Macro Definition Documentation

◆ INTRO_OPT_AGENT_INJECTION

◆ INTRO_OPT_BUGCHECK_CLEANUP

◆ INTRO_OPT_DEFAULT_OPTIONS

◆ INTRO_OPT_DEFAULT_XEN_OPTIONS

◆ INTRO_OPT_DYNAMIC_OPTIONS_MASK

◆ INTRO_OPT_ENABLE_AV_PROTECTION

◆ INTRO_OPT_ENABLE_CR_PROTECTION

◆ INTRO_OPT_ENABLE_DTR_PROTECTION

◆ INTRO_OPT_ENABLE_FULL_PATH

◆ INTRO_OPT_ENABLE_INTEGRITY_CHECKS

◆ INTRO_OPT_ENABLE_KM_BETA_DETECTIONS

◆ INTRO_OPT_ENABLE_KM_PROTECTION

◆ INTRO_OPT_ENABLE_MANUAL_AGENT_INJ

◆ INTRO_OPT_ENABLE_MISC_EVENTS

◆ INTRO_OPT_ENABLE_MSR_PROTECTION

◆ INTRO_OPT_ENABLE_UM_PROTECTION

◆ INTRO_OPT_ENABLE_XEN_PROTECTION

◆ INTRO_OPT_EVENT_CONNECTIONS

◆ INTRO_OPT_EVENT_MODULES

◆ INTRO_OPT_EVENT_OS_CRASH

◆ INTRO_OPT_EVENT_PROCESS_CRASH

◆ INTRO_OPT_EVENT_PROCESSES

◆ INTRO_OPT_FULL_PATH

◆ INTRO_OPT_IN_GUEST_PT_FILTER

◆ INTRO_OPT_KM_BETA_DETECTIONS

◆ INTRO_OPT_NOTIFY_ENGINES

◆ INTRO_OPT_ONLY_KERNEL

◆ INTRO_OPT_PANIC_CLEANUP

◆ INTRO_OPT_PROT_DPI

◆ INTRO_OPT_PROT_DPI_DEBUG

◆ INTRO_OPT_PROT_DPI_HEAP_SPRAY

◆ INTRO_OPT_PROT_DPI_SD_ACL

◆ INTRO_OPT_PROT_DPI_STACK_PIVOT

◆ INTRO_OPT_PROT_DPI_THREAD_SHELL

◆ INTRO_OPT_PROT_DPI_TOKEN_PRIVS

◆ INTRO_OPT_PROT_DPI_TOKEN_STEAL

◆ INTRO_OPT_PROT_KM_AV_DRIVERS

◆ INTRO_OPT_PROT_KM_CR4

◆ INTRO_OPT_PROT_KM_CREDS

◆ INTRO_OPT_PROT_KM_DRVOBJ

◆ INTRO_OPT_PROT_KM_GDTR

◆ INTRO_OPT_PROT_KM_HAL

◆ INTRO_OPT_PROT_KM_HAL_DISP_TABLE

◆ INTRO_OPT_PROT_KM_HAL_HEAP_EXEC

◆ INTRO_OPT_PROT_KM_HAL_INT_CTRL

◆ INTRO_OPT_PROT_KM_HAL_PERF_CNT

◆ INTRO_OPT_PROT_KM_IDT

◆ INTRO_OPT_PROT_KM_IDTR

◆ INTRO_OPT_PROT_KM_INTERRUPT_OBJ

◆ INTRO_OPT_PROT_KM_LOGGER_CONTEXT

◆ INTRO_OPT_PROT_KM_LX

◆ INTRO_OPT_PROT_KM_LX_MODULES

◆ INTRO_OPT_PROT_KM_LX_TEXT_READS

◆ INTRO_OPT_PROT_KM_MSR_SYSCALL

◆ INTRO_OPT_PROT_KM_NT

◆ INTRO_OPT_PROT_KM_NT_DRIVERS

◆ INTRO_OPT_PROT_KM_NT_EAT_READS

◆ INTRO_OPT_PROT_KM_SD_ACL

◆ INTRO_OPT_PROT_KM_SELF_MAP_ENTRY

◆ INTRO_OPT_PROT_KM_SSDT

◆ INTRO_OPT_PROT_KM_SUD_EXEC

◆ INTRO_OPT_PROT_KM_SUD_INTEGRITY

◆ INTRO_OPT_PROT_KM_SWAPGS

◆ INTRO_OPT_PROT_KM_SYSTEM_CR3

◆ INTRO_OPT_PROT_KM_TOKEN_PRIVS

◆ INTRO_OPT_PROT_KM_TOKEN_PTR

◆ INTRO_OPT_PROT_KM_VDSO

◆ INTRO_OPT_PROT_KM_XEN_DRIVERS

◆ INTRO_OPT_PROT_UM_MISC_PROCS

◆ INTRO_OPT_PROT_UM_SYS_PROCS

◆ INTRO_OPT_SYSPROC_BETA_DETECTIONS

◆ INTRO_OPT_VE

◆ POLICY_KM_BETA_FLAGS