ABUSING VBS ENCLAVES TO CREATE EVASIVE MALWARE

Summary from the TLDR InfoSec newsletter

VBS enclaves allow a Windows user to run code in an isolated memory region that even the “standard” kernel cannot access. This presents an appealing attack surface for malware, as VBS malware would be invisible to EDR running in the standard kernel, but the VBS enclave code must be signed by Microsoft. This post explores bypassing the Microsoft checks by abusing debuggable enclave modules or exploiting vulnerable enclaves.