ELAM, or Early Launch Anti-Malware, is a Windows boot mechanism that lets anti-malware load before non-Microsoft boot drivers. The goal is to give security software an early foothold during startup, before other kernel components and services can influence the system.
This matters because the boot phase is a high-trust moment: if malicious or abused drivers load too early, they may disable defenses, hide files, or alter registry settings before endpoint tools are fully active. ELAM is meant to reduce that risk by helping anti-malware initialize first and inspect early-start drivers. In real-world defense, it can improve visibility into boot-time threats and tampering. In attack scenarios, adversaries may try to bypass, weaken, or abuse the trust chain around boot drivers so that security products never get a fair chance to start.