{
  "version": 1,
  "counts": {
    "defenses": 12,
    "techniques": 65
  },
  "defenses": [
    {
      "title": "App Control for Business",
      "page": "docs/mitigations/app-control-for-business.md",
      "url": "mitigations/app-control-for-business/",
      "roster_ids": [
        "wdac-usermode"
      ],
      "techniques": [
        {
          "name": "No policy is deployed",
          "cat": "absent-gate",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Policy is in audit mode",
          "cat": "absent-gate",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Replace or delete the policy file",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Trusted signed binary that runs arbitrary code",
          "cat": "logic-bug",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Edit the enforced policy state from kernel",
          "cat": "integrity-check-evasion",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "Credential Guard",
      "page": "docs/mitigations/credential-guard.md",
      "url": "mitigations/credential-guard/",
      "roster_ids": [
        "credential-guard"
      ],
      "techniques": [
        {
          "name": "Read LSASS secrets directly",
          "cat": "isolation",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "inferred"
        },
        {
          "name": "Sidestep: relay and prompt attacks",
          "cat": "sidestep",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "inferred"
        },
        {
          "name": "Downgrade: suppress VBS on next boot",
          "cat": "downgrade",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "Vulnerable driver blocklist",
      "page": "docs/mitigations/driver-blocklist.md",
      "url": "mitigations/driver-blocklist/",
      "roster_ids": [
        "driver-blocklist"
      ],
      "techniques": [
        {
          "name": "Driver published or weaponized before the list catches it",
          "cat": "list-lag",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "cited"
        },
        {
          "name": "Windows-shipped driver: beyond BYOVD",
          "cat": "unlistable",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "cited"
        },
        {
          "name": "Stale list on an unmanaged machine",
          "cat": "list-lag",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "Driver Signature Enforcement",
      "page": "docs/mitigations/dse.md",
      "url": "mitigations/dse/",
      "roster_ids": [
        "dse"
      ],
      "techniques": [
        {
          "name": "BYOVD: load a signed vulnerable driver",
          "cat": "signed-driver-abuse",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "cited"
        },
        {
          "name": "Flip code-integrity flags at runtime",
          "cat": "policy-edit",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "inferred"
        },
        {
          "name": "Enable test-signing boot configuration",
          "cat": "config-abuse",
          "layer": "kernel",
          "asOf": "2026-09-30",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "HLAT",
      "page": "docs/mitigations/hlat.md",
      "url": "mitigations/hlat/",
      "roster_ids": [
        "hlat"
      ],
      "techniques": [
        {
          "name": "Kernel table hijack via FWA clone (SSDT, IDT, GDT)",
          "cat": "table-hijack",
          "layer": "kernel",
          "asOf": "2026-10-03",
          "basis": "inferred"
        },
        {
          "name": "Page swap against supervisor data pages",
          "cat": "page-swap",
          "layer": "kernel",
          "asOf": "2026-10-03",
          "basis": "cited"
        },
        {
          "name": "User-mode access through a remapped guest PTE",
          "cat": "pte-remap",
          "layer": "kernel",
          "asOf": "2026-10-03",
          "basis": "inferred"
        },
        {
          "name": "Data-only attacks that never touch translation",
          "cat": "data-only",
          "layer": "kernel",
          "asOf": "2026-10-03",
          "basis": "cited"
        }
      ]
    },
    {
      "title": "KASLR",
      "page": "docs/mitigations/kaslr-bypasses.md",
      "url": "mitigations/kaslr-bypasses/",
      "roster_ids": [],
      "techniques": [
        {
          "name": "NtQuerySystemInformation: SystemModuleInformation (class 11)",
          "cat": "API disclosure",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "NtQuerySystemInformation: SystemBigPoolInformation (class 66)",
          "cat": "API disclosure",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "NtQuerySystemInformation: SystemExtendedHandleInformation (class 64)",
          "cat": "API disclosure",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "EnumDeviceDrivers / GetDeviceDriverBaseAddress (PSAPI)",
          "cat": "API disclosure",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "NtQueryVirtualMemory: MemoryWorkingSetExInformation",
          "cat": "API disclosure (indirect)",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "ETW kernel-logger pointer leaks",
          "cat": "ETW",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Prefetch timing side-channel",
          "cat": "Timing side-channel",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Entropy brute-force (256 bases)",
          "cat": "Timing side-channel",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Interrupt timing side-channel",
          "cat": "Timing side-channel",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "SepMediumDaclSd: DACL zeroing",
          "cat": "SD corruption",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "SepMediumDaclSd: Control bit-flip (SE_SACL_PRESENT)",
          "cat": "SD corruption",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "WIL feature-flag bypass (Feature_RestrictKernelAddressLeaks)",
          "cat": "SD corruption",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Driver-specific info-disclosure vuln",
          "cat": "Driver info leak",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        }
      ]
    },
    {
      "title": "kCFG / kCET",
      "page": "docs/mitigations/kcfg-kcet.md",
      "url": "mitigations/kcfg-kcet/",
      "roster_ids": [
        "kcet"
      ],
      "techniques": [
        {
          "name": "CFG-valid gadgets (\"CFG-aware\")",
          "cat": "Forward-edge",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Data-only attacks",
          "cat": "Data-only",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Third-party driver gaps (no /guard:cf)",
          "cat": "Coverage gap",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Unprotected callbacks (exception / APC / I/O completion)",
          "cat": "Coverage gap",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "ROP chains (classic)",
          "cat": "Code reuse",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Stack pivot",
          "cat": "Code reuse",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "kCET shadow-stack direct bypass",
          "cat": "Hardware",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "LSA Protection",
      "page": "docs/mitigations/lsa-protection.md",
      "url": "mitigations/lsa-protection/",
      "roster_ids": [
        "lsa-protection"
      ],
      "techniques": [
        {
          "name": "Kernel-context read of LSASS memory",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "inferred"
        },
        {
          "name": "Dump via vulnerable signed driver",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "cited"
        },
        {
          "name": "Abuse a PPL-signed host as a proxy",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-30",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "Protected Process Light",
      "page": "docs/mitigations/protected-process.md",
      "url": "mitigations/protected-process/",
      "roster_ids": [
        "protected-process"
      ],
      "techniques": [
        {
          "name": "EPROCESS.Protection downgrade",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Handle duplication via signed driver",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Protected-process termination",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-03",
          "basis": "cited"
        }
      ]
    },
    {
      "title": "Smart App Control",
      "page": "docs/mitigations/smart-app-control.md",
      "url": "mitigations/smart-app-control/",
      "roster_ids": [
        "smart-app-control"
      ],
      "techniques": [
        {
          "name": "The feature is not enforcing",
          "cat": "absent-gate",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Policy tampering from kernel",
          "cat": "integrity-check-evasion",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Administrator disables the feature",
          "cat": "privilege-object",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "cited"
        },
        {
          "name": "Signed or reputable code",
          "cat": "logic-bug",
          "layer": "user",
          "asOf": "2026-09-07",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "SMEP / SMAP",
      "page": "docs/mitigations/smep-smap.md",
      "url": "mitigations/smep-smap/",
      "roster_ids": [
        "smap"
      ],
      "techniques": [
        {
          "name": "PTE remapping (clear the U/S bit)",
          "cat": "PTE",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Data-only attacks",
          "cat": "Data-only",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "KUSER_SHARED_DATA staging",
          "cat": "Data staging",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "CR4 bit-flip via ROP (clear SMEP)",
          "cat": "Code reuse",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "STAC via ROP (defeat SMAP)",
          "cat": "Code reuse",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "MDL remapping (MmMapLockedPagesSpecifyCache)",
          "cat": "Historical",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        }
      ]
    },
    {
      "title": "VBS / HVCI",
      "page": "docs/mitigations/vbs-hvci.md",
      "url": "mitigations/vbs-hvci/",
      "roster_ids": [
        "hvci"
      ],
      "techniques": [
        {
          "name": "Data-only attacks (token swap, PreviousMode, ACL/SD)",
          "cat": "Data-only",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Living-off-the-land signed code / I/O Ring",
          "cat": "Signed-code reuse",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Data-only BYOVD (token swap via signed driver)",
          "cat": "BYOVD",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Unblocklistable driver (e.g. NVDrv)",
          "cat": "BYOVD",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "VBS \"Windows Downdate\" (CVE-2024-21302)",
          "cat": "Attack VBS itself",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Kernel shellcode injection",
          "cat": "Code execution",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "PTE manipulation for code execution",
          "cat": "Code execution",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Unsigned driver loading",
          "cat": "Code integrity",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "Capcom-style CR4 / user-mode shellcode BYOVD",
          "cat": "BYOVD (code)",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "cited"
        },
        {
          "name": "Blocklisted MmMapIoSpace drivers (RTCore64, gdrv, ATSZIO64\u2026)",
          "cat": "BYOVD",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        },
        {
          "name": "VTL 0 \u2192 VTL 1 secure-call interface abuse",
          "cat": "Hypervisor surface",
          "layer": "kernel",
          "asOf": "2026-09-03",
          "basis": "inferred"
        }
      ]
    }
  ]
}