Working on a new version of my Hyper-V backdoor with some cool features related to Virtual Secure Mode introspection. For example, it can patch image policy metadata which allows to debug trustlet processes like LsaIso.exe (Credential Guard) running under the secure kernel

Among other interesting things it also can patch skci.dll (which is responsible for Virtual Secure Mode code integrity) and load your own trustlets into the Isolated User Mode

PS: signed insecure Kaspersky bootloader (aka KB4524244) found by @ValdikSS is awesome: to deploy my backdoor and bypass Secure Boot I don't have to use any special hardware for pre-boot DMA attacks anymore

/cc @gentilkiwi You might find it interesting