About Protected Process Light (PPL) technology for Windows

2018 Jul 27 ID: 13905
This article concerns Windows 8.1 and later.

The Protected Process Light (PPL) technology has been implemented in Windows 8.1, which ensures that the operating system only loads trusted services and processes. They should have an internal or external signature that meets the Windows requirements.

Protected Process Light (PPL) technology is used for controlling and protecting running processes and protecting them from infection by malicious code and the potentially harmful effects of other processes.
These processes include:

  • Shutdown
  • Stream deployment
  • Access to virtual memory
  • Debugging
  • Copying of descriptors
  • Changing the memory working set
  • Changing and receiving information about the current state of the thread 
  • Impersonation of threads (running process threads under a different account)

The Protected Process Light (PPL) technology is used in Kaspersky Lab products, as well as self-defense mechanisms and technology that controls file integrity.

Did you find what you were searching for?
Thank you for your feedback!