[Alex]

You can for example try to hide your process or use some tricks like in this PoC (Sudami KillMe), but

User that has admin rights can use million + 1 ways to terminate your program.

[Xearinox]

What is the sense in protecting from Kernel mode access? Absolutely no sense and wasting of time.
I can kill your process simple having only PEPROCESS.

Dear EP_X0FF, how to get "simple having only PEPROCESS" ? :?

[EP_X0FF]

Dear EP_X0FF, how to get "simple having only PEPROCESS" ? :?

What? PsLookupProcessByProcessId then do whatever you want with process.

[Xearinox]

Och, I think, you know different method. :)

[EP_X0FF]

Och, I think, you know different method. :)

ObReferenceObjectByHandle, KeStackAttachProcess, write junk to UM, detach, dereference. I don't undestand your question if any.

[Xearinox]

Many thanks for response.