Skip to content

Instantly share code, notes, and snippets.

View PaulDance's full-sized avatar

Paul Mabileau PaulDance

View GitHub Profile
@jsecurity101
jsecurity101 / ProtectionChecks.ps1
Last active March 28, 2025 21:53
Powershell script that will pull whether a process or service is running as protected (PPL).
#Author: Jonthan Johnson (@jsecurity101)
if (-not ('ProtectedObjects.ProcessNativeMethods' -as [Type])) {
$TypeDef = @'
using System;
using System.Runtime.InteropServices;
namespace ProtectedObjects {
[Flags]
public enum ProcessAccess {