Bypass Record
Rootkit × Microsoft Windows Patch Guard
A publicly-reported instance of Rootkit bypassing Microsoft Windows Patch Guard, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Hooks NtCreateFile and NtOpenProcess to bypass Patch Guard, avoiding system crashes for extended periods. This defeats kernel integrity protections, potentially allowing undetected malicious kernel-mode activity.
Detection & mitigation
Monitor for kernel-mode hooks on critical system calls like NtCreateFile and NtOpenProcess using integrity-checking tools or ETW providers (e.g., Microsoft-Windows-Threat-Intelligence). Deploy Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) to enforce kernel integrity and prevent unauthorized modifications.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.