Blocking System Shutdown for Malware Analysis Without SSDT Hooks

Question

I have a malware sandbox that worked by disabling patchguard so that SSDT functions could be hooked by a driver, but in windows 11 it appears this won't be possible anymore due to secureboot.

I have found that there appears to be no sanctioned way to completely prevent a system shutdown (without hooking SSDT functions).

The only things I can find are:

• PoRegisterPowerSettingsCallback -- which is notification only
• ShutdownBlockReasonCreate -- which is ring3 and bypass-able
• hook ring3 shutdown apis -- again only ring3 and bypass-able

None of these will 100% block a malware from shutting down the VM, this prevents my software from finishing it's job and preparing a report.

Is my best option just to delay the shutdown so I can wrap up the scan then allow it to shutdown anyway?