0-Day Exploit Chain for Bypassing Windows ELAM for Sale
Dark Web5h ago
For informational purposes only.
Price: $5,000 for both exploits
The author claims to be selling two allegedly working 0-day exploits targeting ELAM (Early Launch Anti-Malware)—a Windows mechanism responsible for early driver verification during OS boot.
According to the seller, the exploit chain includes:
- Part 1: ELAM Kill Switch Complete disabling or bypassing of the ELAM mechanism.
- Part 2: Driver Classification Exploit Manipulation of driver classification, allowing the system to accept a potentially malicious driver as legitimate.
The author claims that this chain allows bypassing kernel security restrictions during the Windows boot phase and potentially achieving code execution in Ring 0 (the most privileged level of code execution in the x86/x64 processor architecture).
If successfully exploited, this chain of attacks could potentially allow an attacker to interfere with the driver verification process early in the Windows boot process, creating conditions for the covert execution of malicious code at the kernel level and making it difficult for security tools to detect.
In the discussion, the seller specifically mentions Microsoft Defender, Sophos, and Avast as products that use ELAM.
Vendors
Products