KslDump claims a local admin can redirect Defender back to an older Microsoft-signed KslD.sys and use IOCTL 0x222044 to read LSASS memory past PPL. The repo gives concrete primitives like SubCmd 12 wrapping MmCopyMemory, but the retained evidence is still a repository claim, so the useful click is the control-plane gap and what defenders could verify on disk and in service logs.