mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 22:33:41 +00:00
add emet compare topic
This commit is contained in:
Iaan D'Souza-Wiltshire
@ -30,14 +30,83 @@ ms.date: 08/25/2017
|
||||
- Enterprise security administrators
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10. You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
|
||||
|
||||
|
||||
The Enhanced Mitigation Experience Toolkit (EMET) is a stand-alone product that is available on earlier versions of Windows and provides a number of system- and app-based mitigations against known exploit techniques.
|
||||
|
||||
After July 31, 2018, it will reach its end of life, which means it will not be supported and no additional development will be made for it.
|
||||
|
||||
In Windows 10, version 1709 (also known as the Fall Creators Update), we released Windows Defender Exploit Guard, which provides unparalleled mitigation of known and unknown threat attack vectors, including exploits.
|
||||
|
||||
Windows Defender Exploit Guard is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
|
||||
|
||||
|
||||
|
||||
We're still working on this content and will have it published soon!
|
||||
## Feature comparison
|
||||
|
||||
The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
|
||||
|
||||
| Windows Defender Exploit Guard | EMET
|
||||
-|:-:|:-:
|
||||
Windows versions | [!include[Check mark yes](images/svg/check-yes.md)] <br />All version of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.md)] <br />Windows 8.1; Windows 8; Windows 7
|
||||
Supportability | [!include[Check mark yes](images/svg/check-yes.md)] <br />[Dedicated submission-based support channel](https://www.microsoft.com/en-us/wdsi/filesubmission)<sup id="ref1">[[1](#fn1)]</sup> | [!include[Check mark no](images/svg/check-no.md)]<br />Ends after July 31, 2018
|
||||
Updates | [!include[Check mark yes](images/svg/check-yes.md)] <br />Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.md)]<br />No planned updates or development
|
||||
Exploit protection | [!include[Check mark yes](images/svg/check-yes.md)] <br />All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison)) | [!include[Check mark yes](images/svg/check-yes.md)] <br />Limited set of mitigations
|
||||
[Attack surface reduction](attack-surface-reduction-exploit-guard.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />[Configuration of individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />No rule configuration, limited ruleset
|
||||
[Network protection](network-protection-exploit-guard.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />Available | [!include[Check mark no](images/svg/check-no.md)]<br />Not available
|
||||
[Controlled folder access](controlled-folders-exploit-guard.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />Available and [configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.md)]<br />Not available
|
||||
Manageability with | [!include[Check mark yes](images/svg/check-yes.md)] <br />Group policy, Windows GUI, System Center Configuration Manager, Intune | [!include[Check mark yes](images/svg/check-yes.md)] <br />Group Policy, standalone GUI, System Center Configuration Manager
|
||||
Reporting | [!include[Check mark yes](images/svg/check-yes.md)] <br />[With Windows event logs](event-views-exploit-guard.md) and full [audit mode reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />Limited Windows event log monitoring
|
||||
[Audit mode](audit-windows-defender-exploit-guard.md) | [!include[Check mark yes](images/svg/check-yes.md)] <br />Available | [!include[Check mark no](images/svg/check-no.md)]<br />Not available
|
||||
|
||||
<span id="fn1"></span>([1](#ref1)) Support coming in December 2017. Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/en-us/licensing/licensing-programs/software-assurance-default.aspx).
|
||||
|
||||
|
||||
|
||||
Check out the following topics for more information about Exploit protection:
|
||||
|
||||
|
||||
## Mitigation comparison
|
||||
|
||||
The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [Exploit protection feature](exploit-protection-exploit-guard.md).
|
||||
|
||||
The table in this section indicates the availability of mitigations between EMET and Exploit protection.
|
||||
|
||||
Mitigation | Description | Available in Windows Defender Exploit Guard | Available in EMET
|
||||
-|-|:-:|:-:
|
||||
Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Validate heap integrity | Terminates a process when heap corruption is detected. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Block low integrity images | Prevents the loading of images marked with Low Integrity. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Block remote images | Prevents loading of images from remote devices. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Code integrity guard | Restricts loading of images signed by Microsoft, WQL, and higher. Can optionally allow Microsoft Store signed images. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Disable Win32k system calls | Prevents an app from using the Win32k system call table. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Do not allow child processes | Prevents an app from creating child processes. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Validate handle usage | Causes an exception to be raised on any invalid handle references. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark no](images/svg/check-no.md)]
|
||||
Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. | [!include[Check mark yes](images/svg/check-yes.md)] | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
heap spray allocation? | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
NullPage Security Mitigation | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Load Library Check <20> Return Oriented Programming (ROP) Security Mitigation | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Memory Protection Check <20> Return Oriented Programming (ROP) Security Mitigation | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Advanced ROP - Deep hooks | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Advanced ROP - Anti detours | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Advanced ROP - Banned functions | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
Certificate trust (configurable certificate pinning) | | | [!include[Check mark yes](images/svg/check-yes.md)]
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
|
||||
- [Evaluate Exploit protection](evaluate-exploit-protection.md)
|
||||
|
||||
Reference in New Issue
Block a user