Protected process light and app hardening

Question

Hello Folks,

PPL documentation at https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-#introduction says,

"Processes that have UI or a GUI cannot be protected because of the way the kernel locks a process in memory and does not allow writes to it."

What happens to the child processes created by protected process? Above restrictions applies to them as well?

Also, is there any other mechanism you would like to recommend to protect a process with GUI? The idea is to protect the process in such way that no malware can open/read/write into my processes. Malware may running in same user context or with higher privilege.

Perhaps, a process filter driver? Any ideas around this?

-- Vikram

Answer 1

Yes, according to UpdateProcThreadAttribute,

In order to launch the child process with the same protection level as the parent, the parent process must specify the PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL attribute for the child process. This can be used for both protected and unprotected processes. For example, when this flag is used by an unprotected process, the system will launch a child process at unprotected level. The CREATE_PROTECTED_PROCESS flag must be specified in both cases.

Another mechanism I come up with is AppContainer Isolation.