mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
exp prot updates
This commit is contained in:
Iaan D'Souza-Wiltshire
@ -1,7 +1,7 @@
|
||||
---
|
||||
title:
|
||||
description:
|
||||
keywords:
|
||||
title: See how Exploit Protection works in a demo
|
||||
description: See how Exploit Protection can prevent suspicious behaviors from occurring on specific apps.
|
||||
keywords: exploit protection, exploits, kernel, events, evaluate, demo, try, mitigiation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
@ -15,187 +15,99 @@ ms.author: iawilt
|
||||
|
||||
|
||||
|
||||
## Exploit Protection
|
||||
# Evaluate Exploit Protection
|
||||
|
||||
|
||||
Exploit Protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
|
||||
|
||||
Many of the features that are part of the Enhance Mitigation Experience Toolkit (EMET) are included in Exploit Protection. See the [Comparison between EMET and Exploit Protection](emet-exploit-protection-exploit-guard.md).
|
||||
|
||||
This topcs helps you evaluate Exploit Protection. See the [Exploit Protection topic](exploit-protection-exploit-guard.md) for more information on what Exploit Protection does and how to configure it for real-world deployment.
|
||||
|
||||
>[NOTE]
|
||||
>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it.
|
||||
>For instructions on how to use Group Policy and Mobile Device Management (MDM to deploy these settings across your network, see the main [Exploit Protection topic](exploit-protection-exploit-guard.md) .
|
||||
|
||||
|
||||
## Enable and validate an Exploit Protection mitigation
|
||||
|
||||
For this demo we're going to enable the mitigation that prevents child processes from being created. We'll use Internet Explorer as the parent app.
|
||||
|
||||
First, enable the mitigation using PowerShell, and then confirm that it has been applied in the Windows Defender Security Center app:
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set<65>ProcessMitigation <20>Name iexplore.exe <20>Enable DisallowChildProcessCreation
|
||||
```
|
||||
|
||||
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then **Exploit protection settings** at the bottom of the screen.
|
||||
|
||||
3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
|
||||
|
||||
4. Find the **Do not allow child processes** setting and make sure that **Override System settings** is enabled and the switch is set to **On**.
|
||||
|
||||
Now that we know the mitigation has been enabled, we can test to see if it works and what the experience would be for an end user:
|
||||
|
||||
1. Type **run** in the Start menu andp ress **Enter** to open the run dialog box.
|
||||
|
||||
2. Type **iexplore.exe** and press **Enter** or click **OK** to attempt to open Internet Explorer.
|
||||
|
||||
3. Internet Explorer should briefly open and then immediately shut down again, indicating that the mitigation was applied and prevented Internet Explorer from opening a child process (its own process).
|
||||
|
||||
Lastly, we can disable the mitigation so that Internet Explorer works properly again:
|
||||
|
||||
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then **Exploit protection settings** at the bottom of the screen.
|
||||
|
||||
3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
|
||||
|
||||
4. Find the **Do not allow child processes** setting and set the switch to **Off**. Click **Apply**
|
||||
|
||||
5. Validate that Internet Explorer runs by running it from the run dialog box again. It should open as expected.
|
||||
|
||||
|
||||
## Review Exploit Protection events in Windows Event Viewer
|
||||
|
||||
You can now review the events that Exploit Protection sent to the Windows Event log to confirm what happened:
|
||||
|
||||
1. Download the [Exploit Guard Evaluation Package](#) and extract the file *ep-events.xml* to an easily accessible location on the machine.
|
||||
|
||||
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
|
||||
3. On the left panel, under **Actions**, click **Import custom view...**
|
||||
|
||||
4. Navigate to where you extracted *ep-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
5. This will create a custom view that filters to only show the following events related to Exploit Protection, which are all listed in the [Exploit Protection](exploit-protection-exploit-guard.md) topic.
|
||||
|
||||
6. The specific event to look for in this demo is event ID 4, which should have the following or similar information:
|
||||
|
||||
Process '\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe' (PID 4692) was blocked from creating a child process 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' with command line '"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:75009 /prefetch:2'.
|
||||
|
||||
|
||||
## Use audit mode to measure impact
|
||||
|
||||
As with other Windows Defender EG features, you can enable Exploit Protection in audit mode. You can enable audit mode for individual mitigations.
|
||||
|
||||
This lets you see a record of what *would* have happened if you had enabled the mitigation.
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious or malicious events generally occur over a certain period.
|
||||
|
||||
See the [**PowerShell reference** section in the Customize Exploit Protection topic](customize-exploit-protection.md#powershell-reference) for a list of which mitigations can be audited and instructions on enabling the mode.
|
||||
|
||||
For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
|
||||
|
||||
|
||||
|
||||
Component | Configuration available with | Event ID | Corresponds to<74>
|
||||
-|-|-|-
|
||||
Exploit Protection | GP, MDM, PS & UI | Provider: Security-Mitigations |
|
||||
| | | 1 | ACG audit
|
||||
| | | 2 | ACG enforce
|
||||
| | | 3 | Do not allow child processes audit
|
||||
| | | 4 | Do not allow child processes block
|
||||
| | | 5 | Block low integrity images audit
|
||||
| | | 6 | Block low integrity images block
|
||||
| | | 7 | Block remote images audit
|
||||
| | | 8 | Block remote images block
|
||||
| | | 9 | Disable win32k system calls audit
|
||||
| | | 10 | Disable win32k system calls block
|
||||
| | | 11 | Code integrity guard audit
|
||||
| | | 12 | Code integrity guard block
|
||||
| | | 13 | EAF audit
|
||||
| | | 14 | EAF enforce
|
||||
| | | 15 | EAF+ audit
|
||||
| | | 16 | EAF+ enforce
|
||||
| | | 17 | IAF audit
|
||||
| | | 18 | IAF enforce
|
||||
| | | 19 | ROP StackPivot audit
|
||||
| | | 20 | ROP StackPivot enforce
|
||||
| | | 21 | ROP CallerCheck audit
|
||||
| | | 22 | ROP CallerCheck enforce
|
||||
| | | 23 | ROP SimExec audit
|
||||
| | | 24 | ROP SimExec enforce
|
||||
Exploit Protection | GP, MDM, PS & UI |Provider: WER-Diagnostics |
|
||||
| | | 5 | CFG Block
|
||||
Exploit Protection | GP, MDM, PS & UI | Provider: Win32K |
|
||||
| | | 260 | Untrusted Font
|
||||
|
||||
|
||||
|
||||
### Audit/block modes
|
||||
Each of these components can individually be enabled in audit or blocking mode.
|
||||
|
||||
Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode.
|
||||
|
||||
|
||||
|
||||
Component |Description |Rule/mitigation description |
|
||||
-|-|-|-
|
||||
Exploit Protection |Provides memory, control flow and policy restrictions that can be used to protect an application from exploits. - Each mitigation can be enabled in audit/block mode |Memory exploit mitigation | DEP
|
||||
| | | | ForceASLR
|
||||
| | | | BottomUpASLR
|
||||
| | | | HeapTermination
|
||||
| | | | SEHOP
|
||||
| | | | CFG
|
||||
| | | | Strict handle checks
|
||||
| | | | ACG
|
||||
| | | | Untrusted font blocking
|
||||
| | | | No child process
|
||||
| | | | Win32k syscall disable
|
||||
| | | | Extension point disable
|
||||
| | | | Various image loading restrictions
|
||||
| | | | Anti-ROP (CallerCheck, SimExec, StackPivot)
|
||||
| | | | EAF, EAF+
|
||||
| | | Control Flow mitigation |
|
||||
| | | Process restrictions |
|
||||
|
||||
|
||||
|
||||
## Policy settings for Windows Defender EG
|
||||
The MDM policy settings for Windows Defender EG are listed in this section, along with example settings.
|
||||
### Exploit Protection
|
||||
Exploit Protection has an improved manageability experience over EMET, including support for SCCM, Intune, Powershell, and Group Policy management.
|
||||
>
|
||||
> Note: SCCM and Intune will be supported in furture releases.
|
||||
You can specify a common set of WD Exploit Guard system and application mitigation settings that can be applied to all endpoints that have this GP setting configured.
|
||||
Note, however, that there are some prerequisites before you can enable this setting:
|
||||
- Manually configure a device's system and application mitigation settings using the *Set-ProcessMitigation* PowerShell cmdlet, the *ConvertTo-ProcessMitigationPolicy* PowerShell cmdlet, or directly in the Windows Defender Security Center
|
||||
>
|
||||
> Note: Endpoints that have this GP setting set to **Enabled** must be able to access the XML file, otherwise the settings will not be applied.
|
||||
- Generate an XML file with the settings from the device by running the *Get-ProcessMitigation* PowerShell cmdlet or using the **Export** button at the bottom of the **Exploit Protection** area in the Windows Defender Security Center.
|
||||
- Place the generated XML file in a shared or local path.
|
||||
|
||||
#### Group policy
|
||||
|
||||
The Exploit Protection feature can be configured with the following Group Policy details:
|
||||
- Location: \Microsoft\Windows Defender Exploit Guard\Exploit Protection
|
||||
- Name: Use a common set of Exploit Protection settings
|
||||
- Values: **Enabled**: Specify the location of the XML file in the Options section. You can use a local (or mapped) path, a UNC path, or a URL, such as the following:
|
||||
-- C:\MitigationSettings\Config.XML
|
||||
-- \\Server\Share\Config.xml
|
||||
-- https://localhost:8080/Config.xml
|
||||
|
||||
The settings in the XML file will be applied to the endpoint.
|
||||
|
||||
**Disabled:** Common settings will not be applied, and the locally configured settings will be used instead.
|
||||
|
||||
**Not configured:** Same as **Disabled**.
|
||||
|
||||
#### PowerShell
|
||||
|
||||
You can also use powershell to set these mitigation policies and to convert EMET policies to Windows Defender EG, as demonstrated in the following examples:
|
||||
|
||||
Get the current settings in the registry for processName.exe
|
||||
```
|
||||
Get-ProcessMitigation -Name processName.exe
|
||||
```
|
||||
|
||||
Exports the current settings to the filename.xml
|
||||
```
|
||||
Get-ProcessMitigation -RegistryConfigFilePath filename.xml
|
||||
```
|
||||
|
||||
Imports the settings in filename.xml to the system.
|
||||
```
|
||||
Set-ProcessMitigation -PolicyFilePath filename.xml
|
||||
```
|
||||
|
||||
Enables a list of mitigations
|
||||
```
|
||||
Set-ProcessMitigation -Name processName.exe -Enable SEHOP,DEP
|
||||
```
|
||||
|
||||
Disables a list of mitigations
|
||||
```
|
||||
Set-ProcessMitigation -Name processName.exe -Disable SEHOP,DEP
|
||||
```
|
||||
|
||||
Sets the EAFModules for dllName1.dll & dllName2.dll for processName.exe
|
||||
```
|
||||
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll
|
||||
```
|
||||
|
||||
Converts an emet file named, emetFile.xml, to the new windows 10 format called, filename.xml
|
||||
```
|
||||
ConvertTo-ProcessMitigationPolicy -EMETFilePath emetFile.xml -OutputFilePath filename.xml
|
||||
```
|
||||
|
||||
|
||||
### Make sure things are working
|
||||
|
||||
1. Apply a mitigation setting:
|
||||
a. Launch PowerShell as an admin and run **Set<65>ProcessMitigation <20>Name iexplore.exe <20>Enable DisallowChildProcessCreation**
|
||||
2. Validate that the setting is correctly applied:
|
||||
a. Open Windows Defender Security Center -> App & browser control
|
||||
b. Scroll to the bottom and under **Exploit protection**, click **Exploit protection settings** and navigate to the **Program settings** pivot
|
||||
c. Scroll down to **iexplore.exe**, click on it and click **Edit**
|
||||
d. Find the **Do not allow child processes** setting and make sure that **Override System settings** and **On** are set
|
||||
3. Validate that Internet Explorer won<6F>t run:
|
||||
a. Try launching iexplore.exe via the run dialog
|
||||
b. An IE frame should appear and then close
|
||||
4. Validate that event viewer reports that the mitigation fired:
|
||||
a. Open Event Viewer
|
||||
b. Navigate to Applications and Services Log -> Microsoft -> Windows -> Security-Mitigations -> Kernel Mode
|
||||
c. Check for the following entry for Internet Explorer (event ID 4)
|
||||
|
||||
Process '\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe' (PID 4692) was blocked from creating a child process 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' with command line '"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:75009 /prefetch:2'.
|
||||
|
||||
5. Undo the mitigation setting:
|
||||
a. Open Windows Defender Security Center -> App & browser control
|
||||
b. Scroll to the bottom and under **Exploit protection**, click on **Exploit protection settings** and navigate to the **Program settings** pivot
|
||||
c. Scroll down to **iexplore.exe**, click on it and click **Edit**
|
||||
d. Find the **Do not allow child processes **setting and toggle the **On** to **Off**
|
||||
e. Click **Apply**
|
||||
6. Validate that Internet Explorer runs:
|
||||
a. Try launching iexplore.exe via the run dialog
|
||||
b. IE should open as expected
|
||||
|
||||
|
||||
### Converting and Applying an EMET config:
|
||||
1. Export the existing EMET configuration. This can be done from the "Export" button in the GUI, or by running the command: **emet_conf.exe <20>export emetConfig.xml**
|
||||
2. In an elevated PowerShell window, convert the exported configuration with: **ConvertTo-ProcessMitigationPolicy -EMETFilePath emetConfig.xml -OutputFilePath win10Config.xml**
|
||||
3. Note that this may give you some warnings, but these should be safe to ignore.
|
||||
4. Apply the new configuration: from an elevated PowerShell window run **Set-ProcessMitigation -RegistryConfigFilePath win10Config.xml **
|
||||
5. From here you can check or edit the settings in the new interface in the Windows Defender Security Center or with **Get-ProcessMitigation** (this command by itself will output the entire current state of the mitigations to the shell), and **Set-ProcessMitigation** respectively.
|
||||
|
||||
|
||||
### Managing Exploit Protection through Group Policy
|
||||
1. Launch Group Policy Management Console (gpmc.msc) and from within and existing or new GPO navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection** and open the policy named *Use a common set of exploit protection settings*.
|
||||
2. Enable the setting as seen below and point to an accessible location for the client machines to the recently created XML.
|
||||
3. Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
|
||||
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
|
||||
- [Enable Exploit Protection](enable-exploit-protection.md)
|
||||
|
||||
Reference in New Issue
Block a user