windows-mitigations-bypass

# Windows Mitigations & Bypass Defeating both **exploit mitigations** (ASLR/DEP/CFG/XFG/CET/ACG) and **platform security controls** (WDAC, ASR, AMSI/ETW, PPL/LSA Protection, VBS/HVCI). Every technique is paired with detection + OPSEC so it doubles as defensive hardening guidance. Assumes an authorized engagement. ## When to Activate - Fingerprinting a target's mitigation landscape before weaponizing an exploit - Designing a memory-corruption exploit that must defeat ASLR + DEP + CFG/CET in one chain - Bypassing application control (WDAC / App Control for Business) to run unsigned code - Disabling or blinding telemetry (ASR, AMSI, ETW) ahead of post-exploitation - Dumping a PPL/LSA-protected process (LSASS) or killing a PPL-protected EDR - Deciding between userland-only vs BYOVD/kernel approaches based on VBS/HVCI state ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | ASLR/HEASLR defeat (info leak, partial overwrite, non-ASLR module) | T1211 | CWE-330 | references/memory-safety-mitigations.md | scripts/find_nonaslr_modules.py | | DEP/NX bypass (ROP→VirtualProtect, ret2libc) | T1211 | CWE-119 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | | CFG/XFG bypass (valid-target dispatch gadget, type-hash collision) | T1211 | CWE-1240 | references/memory-safety-mitigations.md | scripts/cfg_dispatch_gadget_finder.py | | CET shadow stack / IBT evasion (non-CET process, JOP, excep...