Bypass Record
Disable or Modify Tools × Riot Games Vanguard anti-cheat
A publicly-reported instance of Disable or Modify Tools bypassing Riot Games Vanguard anti-cheat, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The tool runs with administrator privileges, stops and disables the Vanguard service (vgc), then suspends vgm.exe (the watchdog) and any svchost.exe process that has loaded tpmcore.dll using Sysinternals' pssuspend.exe. This prevents the TPM/Secure Boot popup from appearing, allowing the game to run without the required security features.
Detection & mitigation
Monitor for unexpected termination or suspension of security-related services and processes (e.g., vgc, vgm.exe) using Windows Event ID 7034/7036 (service stop) and Sysmon Event ID 1 (process creation with pssuspend.exe or similar tools). Mitigate by enforcing application control policies to block unauthorized execution of system administration tools and restricting administrative privileges.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.