ELAM (Early Launch Antimalware) and AVs supporting it

If Webroot, or any AV for that matter, is using an ELAM driver, it must be located in the Win drivers directory. Below is a screen shot of Eset's ELAM driver.

Also, for an AV to be registered in MS Security Center, it must be using a MS signed ELAM driver.

 

From the Webroot Log!

Mon 2022-04-04 10:46:17.0556 ScriptShield active config: 2S(2) yes, SR(2) yes, SSH yes, FLR no, RUD yes, SDE(2) yes, DSR no, DQT 65536, MFS 100, USE yes, UNR no
Mon 2022-04-04 10:46:17.0704 ELAM applicable: yes, driver present yes, driver registered yes, PPL: yes, PPL configured: yes, mandated: yes

 

Yes.

Interesting. So almost all AV's already use ELAM or they wouldn't be able to register as an AV.

 

Hello All:

As I am not in the employ of Malwarebytes Corporation et al, therefore my non-authoritative contribution is:

Malwarebytes for Windows Premium has employed Early Launch AntiMalware for approximately five years encompassing versions that first appeared in late MB3 and all of MB4 to present. Some of this feature is within the kernel driver filename MbamElam.sys and others.

HTH