About Protected Process Light (PPL) technology for Windows

This article concerns Windows 8.1 and later.

The Protected Process Light (PPL) technology has been implemented in Windows 8.1, which ensures that the operating system only loads trusted services and processes. They should have an internal or external signature that meets the Windows requirements.

Protected Process Light (PPL) technology is used for controlling and protecting running processes and protecting them from infection by malicious code and the potentially harmful effects of other processes.
These processes include:

• Shutdown
• Stream deployment
• Access to virtual memory
• Debugging
• Copying of descriptors
• Changing the memory working set
• Changing and receiving information about the current state of the thread 
• Impersonation of threads (running process threads under a different account)

The Protected Process Light (PPL) technology is used in Kaspersky Lab products, as well as self-defense mechanisms and technology that controls file integrity.