mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-11 21:07:23 +00:00
adding and removing topics
This commit is contained in:
Beth Levin
parent
52baa2645a
commit
aaad2398d0
@ -860,6 +860,11 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-exploit-guard",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction",
|
||||
@ -1435,6 +1440,11 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection",
|
||||
|
||||
@ -82,6 +82,7 @@
|
||||
#### [Exploit protection]()
|
||||
##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md)
|
||||
##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md)
|
||||
##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md)
|
||||
|
||||
|
||||
#### [Network protection]()
|
||||
@ -100,6 +101,7 @@
|
||||
#### [Controlled folder access]()
|
||||
##### [Protect folders](microsoft-defender-atp/controlled-folders.md)
|
||||
##### [Controlled folder access evaluation](microsoft-defender-atp/evaluate-controlled-folder-access.md)
|
||||
##### [Enable controlled folder access](microsoft-defender-atp/enable-controlled-folders.md)
|
||||
|
||||
|
||||
|
||||
@ -457,7 +459,7 @@
|
||||
#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
|
||||
|
||||
### [Use audit mode](microsoft-defender-atp/audit-windows-defender)
|
||||
|
||||
## Reference
|
||||
### [Management and APIs]()
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Test how Microsoft Defender ATP features work
|
||||
title: Test how Microsoft Defender ATP features work in audit mode
|
||||
description: Audit mode lets you use the event log to see how Microsoft Defender ATP would protect your devices if it was enabled.
|
||||
keywords: exploit guard, audit, auditing, mode, enabled, disabled, test, demo, evaluate, lab
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -16,7 +16,7 @@ ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Use audit mode
|
||||
# Test how Microsoft Defender ATP features work in audit mode
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
@ -10,7 +10,6 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 03/26/2019
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -23,11 +22,11 @@ manager: dansimp
|
||||
|
||||
Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps.
|
||||
|
||||
You configure these settings using the Windows Security app on an individual device, and then export the configuration as an XML file that you can deploy to other devices. You can use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell.
|
||||
Configure these settings using the Windows Security app on an individual device. Then, export the configuration as an XML file so you can deploy to other devices. Use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell.
|
||||
|
||||
This topic lists each of the mitigations available in exploit protection, indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works.
|
||||
This article lists each of the mitigations available in exploit protection. It indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works.
|
||||
|
||||
It also describes how to enable or configure the mitigations using Windows Security, PowerShell, and MDM CSPs. This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating or exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md).
|
||||
It also describes how to enable or configure the mitigations using Windows Security, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating, exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md).
|
||||
|
||||
> [!WARNING]
|
||||
> Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](evaluate-exploit-protection.md) before deploying the configuration across a production environment or the rest of your network.
|
||||
@ -36,20 +35,20 @@ It also describes how to enable or configure the mitigations using Windows Secur
|
||||
|
||||
All mitigations can be configured for individual apps. Some mitigations can also be applied at the operating system level.
|
||||
|
||||
You can set each of the mitigations to on, off, or to their default value. Some mitigations have additional options, these are indicated in the description in the table.
|
||||
You can set each of the mitigations on, off, or to their default value. Some mitigations have additional options that are indicated in the description in the table.
|
||||
|
||||
Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On".
|
||||
|
||||
The **Use default** configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and may need to modify configuration away from the defaults.
|
||||
|
||||
For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this topic.
|
||||
For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this article.
|
||||
|
||||
Mitigation | Description | Can be applied to | Audit mode available
|
||||
-|-|-|-
|
||||
Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
@ -59,14 +58,14 @@ Block untrusted fonts | Prevents loading any GDI-based fonts not installed in th
|
||||
Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Do not allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work:
|
||||
@ -105,9 +104,9 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
|
||||
### Configure system-level mitigations with the Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
|
||||
2. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**.
|
||||
|
||||
3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here:
|
||||
* **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
@ -123,14 +122,14 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi
|
||||
|
||||
5. Go to the **Program settings** section and choose the app you want to apply mitigations to:
|
||||
|
||||
1. If the app you want to configure is already listed, click it and then click **Edit**
|
||||
2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
|
||||
1. If the app you want to configure is already listed, select it and then select **Edit**
|
||||
2. If the app isn't listed, at the top of the list select **Add program to customize** and then choose how you want to add the app:
|
||||
* Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
* Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, select the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
7. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
7. Repeat these steps for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration.
|
||||
|
||||
You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations.
|
||||
|
||||
@ -202,7 +201,7 @@ Where:
|
||||
|
||||
You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below.
|
||||
|
||||
For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used in the example above, you'd use the following command:
|
||||
For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|
||||
@ -248,9 +247,9 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu
|
||||
|
||||
## Customize the notification
|
||||
|
||||
See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file.
|
||||
For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center).
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
|
||||
* [Protect devices from exploits](exploit-protection.md)
|
||||
* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md)
|
||||
|
||||
@ -1,86 +0,0 @@
|
||||
---
|
||||
title: Compare the features in Exploit protection with EMET
|
||||
keywords: emet, enhanced mitigation experience toolkit, configuration, exploit, compare, difference between, versus, upgrade, convert
|
||||
description: Exploit protection in Microsoft Defender ATP is our successor to Enhanced Mitigation Experience Toolkit (EMET) and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 08/08/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP.
|
||||
>
|
||||
> You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
|
||||
|
||||
This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and exploit protection in Microsoft Defender ATP.
|
||||
|
||||
Exploit protection in Microsoft Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
|
||||
|
||||
EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques.
|
||||
|
||||
After July 31, 2018, it will not be supported.
|
||||
|
||||
For more information about the individual features and mitigations available in Microsoft Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
|
||||
|
||||
* [Protect devices from exploits](exploit-protection.md)
|
||||
* [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
|
||||
## Mitigation comparison
|
||||
|
||||
The mitigations available in EMET are included in Windows Defender, under the [exploit protection feature](exploit-protection.md).
|
||||
|
||||
The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection.
|
||||
|
||||
Mitigation | Available in Windows Defender | Available in EMET
|
||||
-|-|-
|
||||
Arbitrary code guard (ACG) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]<br />As "Memory Protection Check"
|
||||
Block remote images | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]<br/>As "Load Library Check"
|
||||
Block untrusted fonts | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Data Execution Prevention (DEP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Export address filtering (EAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
NullPage Security Mitigation | [!include[Check mark yes](../images/svg/check-yes.svg)]<br />Included natively in Windows 10<br/>See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Simulate execution (SimExec) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Validate API invocation (CallerCheck) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Validate exception chains (SEHOP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Validate stack integrity (StackPivot) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection<br/>See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Block low integrity images | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Code integrity guard | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Disable extension points | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Disable Win32k system calls | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Do not allow child processes | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Import address filtering (IAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate handle usage | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate heap integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate image dependency integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
|
||||
> [!NOTE]
|
||||
> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender as part of enabling the anti-ROP mitigations for a process.
|
||||
>
|
||||
> See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology.
|
||||
|
||||
## Related topics
|
||||
|
||||
* [Protect devices from exploits with Windows Defender](exploit-protection.md)
|
||||
* [Evaluate exploit protection](evaluate-exploit-protection.md)
|
||||
* [Enable exploit protection](enable-exploit-protection.md)
|
||||
* [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
|
||||
@ -78,7 +78,7 @@ Enable network protection by using any of these methods:
|
||||
|
||||
5. Select **OK** to save each open section and **Create**.
|
||||
|
||||
6. Select the profile **Assignments**, assign to **All Users & All Devices**, and **Save**.
|
||||
6. Select the profile called **Assignments**, assign to **All Users & All Devices**, and **Save**.
|
||||
|
||||
### Mobile Device Management (MMD)
|
||||
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
---
|
||||
title: Enable Secure Score in Microsoft Defender ATP
|
||||
description: Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard.
|
||||
keywords: enable secure score, baseline, calculation, analytics, score, secure score dashboard, dashboard
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Enable Secure Score security controls
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
Set the baselines for calculating the score of security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
|
||||
|
||||
>[!NOTE]
|
||||
>Changes might take up to a few hours to reflect on the dashboard.
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Secure Score**.
|
||||
|
||||
2. Select the security control, then toggle the setting between **On** and **Off**.
|
||||
|
||||
3. Click **Save preferences**.
|
||||
|
||||
## Related topics
|
||||
- [View the Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md)
|
||||
- [Update data retention settings for Microsoft Defender ATP](data-retention-settings.md)
|
||||
- [Configure alert notifications in Microsoft Defender ATP](configure-email-notifications.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
|
||||
- [Configure advanced features in Microsoft Defender ATP](advanced-features.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use a demo to see how ASR rules can help protect your devices
|
||||
description: The custom demo tool lets you create sample malware infection scenarios so you can see how ASR would block and prevent attacks
|
||||
title: Evaluate attack surface reduction rules
|
||||
description: See how attack surface reduction would block and prevent attacks with the custom demo tool.
|
||||
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, evaluate, test, demo
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
@ -11,7 +11,6 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 05/20/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -22,22 +21,21 @@ manager: dansimp
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Attack surface reduction rules help prevent actions that are typically used by malware to compromise devices or networks. You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
Attack surface reduction rules help prevent actions typically used by malware to compromise devices or networks. Set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Learn how to evaluate attack surface reduction rules, by enabling audit mode to test the feature directly in your organization.
|
||||
Learn how to evaluate attack surface reduction rules by enabling audit mode to test the feature directly in your organization.
|
||||
|
||||
> [!TIP]
|
||||
> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
> You can also visit the Microsoft Defender ATP demo scenario website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## Use audit mode to measure impact
|
||||
|
||||
You can enable attack surface reduction rules in audit mode. This lets you see a record of what apps would have been blocked if you had enabled attack surface reduction rules.
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the rules will fire during normal use.
|
||||
Enable attack surface reduction rules in audit mode to view a record of apps that would have been blocked if the feature was fully enabled. Test how the feature will work in your organization to ensure it doesn't affect your line-of-business apps. You can also get an idea of how often the rules will fire during normal use.
|
||||
|
||||
To enable all attack surface reduction rules in audit mode, use the following PowerShell cmdlet:
|
||||
|
||||
@ -48,13 +46,13 @@ Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode
|
||||
> [!TIP]
|
||||
> If you want to fully audit how attack surface reduction rules will work in your organization, you'll need to use a management tool to deploy this setting to devices in your network(s).
|
||||
|
||||
You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Attack surface reduction rules topic](attack-surface-reduction.md).
|
||||
You can also use Group Policy, Intune, or mobile device management (MDM) configuration service providers (CSPs) to configure and deploy the setting. Learn more in the main [Attack surface reduction rules](attack-surface-reduction.md) article.
|
||||
|
||||
## Review attack surface reduction events in Windows Event Viewer
|
||||
|
||||
To review apps that would have been blocked, open Event Viewer and filter for Event ID 1121 in the Microsoft-Windows-Windows Defender/Operational log. The following table lists all network protection events.
|
||||
|
||||
Event ID | Description
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1121 | Event when an attack surface reduction rule fires in block mode
|
||||
@ -64,9 +62,9 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev
|
||||
|
||||
During your evaluation, you may wish to configure each rule individually or exclude certain files and processes from being evaluated by the feature.
|
||||
|
||||
See the [Customize attack surface reduction rules](customize-attack-surface-reduction.md) topic for information on configuring the feature with management tools, including Group Policy and MDM CSP policies.
|
||||
See [Customize attack surface reduction rules](customize-attack-surface-reduction.md) for information on configuring the feature with management tools, including Group Policy and MDM CSP policies.
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
|
||||
* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md)
|
||||
* [Use audit mode to evaluate Windows Defender](audit-windows-defender.md)
|
||||
|
||||
@ -11,7 +11,6 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 11/16/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -22,20 +21,18 @@ manager: dansimp
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[Controlled folder access](controlled-folders.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients.
|
||||
[Controlled folder access](controlled-folders.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients.
|
||||
|
||||
It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
|
||||
It is especially useful in helping protect against [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that attempts to encrypt your files and hold them hostage.
|
||||
|
||||
This topic helps you evaluate controlled folder access. It explains how to enable audit mode so you can test the feature directly in your organization.
|
||||
This article helps you evaluate controlled folder access. It explains how to enable audit mode so you can test the feature directly in your organization.
|
||||
|
||||
> [!TIP]
|
||||
> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
> You can also visit the Microsoft Defender ATP demo scenario website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
## Use audit mode to measure impact
|
||||
|
||||
You can enable the controlled folder access feature in audit mode. This lets you see a record of what *would* have happened if you had enabled the setting.
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period.
|
||||
Enable the controlled folder access in audit mode to see a record of what *would* have happened if it was fully enabled. Test how the feature will work in your organization to ensure it doesn't affect your line-of-business apps. You can also get an idea of how many suspicious file modification attempts generally occur over a certain period of time.
|
||||
|
||||
To enable audit mode, use the following PowerShell cmdlet:
|
||||
|
||||
@ -45,7 +42,7 @@ Set-MpPreference -EnableControlledFolderAccess AuditMode
|
||||
|
||||
> [!TIP]
|
||||
> If you want to fully audit how controlled folder access will work in your organization, you'll need to use a management tool to deploy this setting to devices in your network(s).
|
||||
You can also use Group Policy, Intune, MDM, or Microsoft Endpoint Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders.md).
|
||||
You can also use Group Policy, Intune, mobile device management (MDM), or Microsoft Endpoint Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders.md).
|
||||
|
||||
## Review controlled folder access events in Windows Event Viewer
|
||||
|
||||
@ -64,9 +61,9 @@ Event ID | Description
|
||||
|
||||
During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files.
|
||||
|
||||
See [Protect important folders with controlled folder access](controlled-folders.md) for configuring the feature with management tools, including Group Policy, PowerShell, and MDM CSP.
|
||||
See [Protect important folders with controlled folder access](controlled-folders.md) for configuring the feature with management tools, including Group Policy, PowerShell, and MDM configuration service providers (CSPs).
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
|
||||
* [Protect important folders with controlled folder access](controlled-folders.md)
|
||||
* [Evaluate Microsoft Defender ATP]../(microsoft-defender-atp/evaluate-atp.md)
|
||||
|
||||
@ -35,6 +35,18 @@ Your score for devices is visible in the [threat and vulnerability management da
|
||||
|
||||
Select a category to go to the [**Security recommendations**](tvm-security-recommendation.md) page and view the relevant recommendations.
|
||||
|
||||
## Turn on the Microsoft Secure Score connector
|
||||
|
||||
Forward Microsoft Defender ATP signals, giving Microsoft Secure Score visibility into the device security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data.
|
||||
|
||||
Changes might take up to a few hours to reflect in the dashboard.
|
||||
|
||||
1. In the navigation pane, go to **Settings** > **Advanced features**
|
||||
|
||||
2. Scroll down to **Microsoft Secure Score** and toggle the setting to **On**.
|
||||
|
||||
3. Select **Save preferences**.
|
||||
|
||||
## How it works
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user