With PPLDescribe, you can retrieve information about processes that are protected by PPL. The tool parses PS_PROTECTION, PS_PROTECTED_TYPE and PS_PROTECTED_SIGNER structures to retrieve the information
Usage:
____ ____ __ ____ _ __
/ __ \/ __ \/ / / __ \___ _______________(_/ /_ ___
/ /_/ / /_/ / / / / / / _ \/ ___/ ___/ ___/ / __ \/ _ \
/ ____/ ____/ /___/ /_/ / __(__ / /__/ / / / /_/ / __/
/_/ /_/ /_____/_____/\___/____/\___/_/ /_/_.___/\___/
https://github.com/MzHmO
Usage:
[Show info by PID] PPLDescriber.exe -p <PID>
Ex: PPLDescriber.exe -p 123
[Show info by process name] PPLDescriber.exe -n <Process Name>
Ex: PPLDescriber.exe -n lsass.exe