9.1 KiB
title, description, keywords, search.product, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, localizationpriority, author, ms.author
| title | description | keywords | search.product | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | localizationpriority | author | ms.author |
|---|---|---|---|---|---|---|---|---|---|---|---|
| eADQiWindows 10XVcnh | security | w10 | manage | library | security | medium | iaanw | iawilt |
Exploit Protection
| Component | Configuration available with | Event ID | Corresponds to… |
|---|---|---|---|
| Exploit Protection | GP, MDM, PS & UI | Provider: Security-Mitigations | |
| 1 | ACG audit | ||
| 2 | ACG enforce | ||
| 3 | Do not allow child processes audit | ||
| 4 | Do not allow child processes block | ||
| 5 | Block low integrity images audit | ||
| 6 | Block low integrity images block | ||
| 7 | Block remote images audit | ||
| 8 | Block remote images block | ||
| 9 | Disable win32k system calls audit | ||
| 10 | Disable win32k system calls block | ||
| 11 | Code integrity guard audit | ||
| 12 | Code integrity guard block | ||
| 13 | EAF audit | ||
| 14 | EAF enforce | ||
| 15 | EAF+ audit | ||
| 16 | EAF+ enforce | ||
| 17 | IAF audit | ||
| 18 | IAF enforce | ||
| 19 | ROP StackPivot audit | ||
| 20 | ROP StackPivot enforce | ||
| 21 | ROP CallerCheck audit | ||
| 22 | ROP CallerCheck enforce | ||
| 23 | ROP SimExec audit | ||
| 24 | ROP SimExec enforce | ||
| Exploit Protection | GP, MDM, PS & UI | Provider: WER-Diagnostics | |
| 5 | CFG Block | ||
| Exploit Protection | GP, MDM, PS & UI | Provider: Win32K | |
| 260 | Untrusted Font |
Audit/block modes
Each of these components can individually be enabled in audit or blocking mode.
Attack Surface Reduction and Controlled Folder Access also have mitigations that can be individually enabled in audit or blocking mode.
| Component | Description | Rule/mitigation description | |
|---|---|---|---|
| Exploit Protection | Provides memory, control flow and policy restrictions that can be used to protect an application from exploits. - Each mitigation can be enabled in audit/block mode | Memory exploit mitigation | DEP |
| ForceASLR | |||
| BottomUpASLR | |||
| HeapTermination | |||
| SEHOP | |||
| CFG | |||
| Strict handle checks | |||
| ACG | |||
| Untrusted font blocking | |||
| No child process | |||
| Win32k syscall disable | |||
| Extension point disable | |||
| Various image loading restrictions | |||
| Anti-ROP (CallerCheck, SimExec, StackPivot) | |||
| EAF, EAF+ | |||
| Control Flow mitigation | |||
| Process restrictions |
Policy settings for Windows Defender EG
The MDM policy settings for Windows Defender EG are listed in this section, along with example settings.
Exploit Protection
Exploit Protection has an improved manageability experience over EMET, including support for SCCM, Intune, Powershell, and Group Policy management.
Note: SCCM and Intune will be supported in furture releases. You can specify a common set of WD Exploit Guard system and application mitigation settings that can be applied to all endpoints that have this GP setting configured. Note, however, that there are some prerequisites before you can enable this setting:
- Manually configure a device's system and application mitigation settings using the Set-ProcessMitigation PowerShell cmdlet, the ConvertTo-ProcessMitigationPolicy PowerShell cmdlet, or directly in the Windows Defender Security Center
Note: Endpoints that have this GP setting set to Enabled must be able to access the XML file, otherwise the settings will not be applied.
- Generate an XML file with the settings from the device by running the Get-ProcessMitigation PowerShell cmdlet or using the Export button at the bottom of the Exploit Protection area in the Windows Defender Security Center.
- Place the generated XML file in a shared or local path.
Group policy
The Exploit Protection feature can be configured with the following Group Policy details:
- Location: \Microsoft\Windows Defender Exploit Guard\Exploit Protection
- Name: Use a common set of Exploit Protection settings
- Values: Enabled: Specify the location of the XML file in the Options section. You can use a local (or mapped) path, a UNC path, or a URL, such as the following: -- C:\MitigationSettings\Config.XML -- \Server\Share\Config.xml -- https://localhost:8080/Config.xml
The settings in the XML file will be applied to the endpoint.
Disabled: Common settings will not be applied, and the locally configured settings will be used instead.
Not configured: Same as Disabled.
PowerShell
You can also use powershell to set these mitigation policies and to convert EMET policies to Windows Defender EG, as demonstrated in the following examples:
Get the current settings in the registry for processName.exe
Get-ProcessMitigation -Name processName.exe
Exports the current settings to the filename.xml
Get-ProcessMitigation -RegistryConfigFilePath filename.xml
Imports the settings in filename.xml to the system.
Set-ProcessMitigation -PolicyFilePath filename.xml
Enables a list of mitigations
Set-ProcessMitigation -Name processName.exe -Enable SEHOP,DEP
Disables a list of mitigations
Set-ProcessMitigation -Name processName.exe -Disable SEHOP,DEP
Sets the EAFModules for dllName1.dll & dllName2.dll for processName.exe
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll
Converts an emet file named, emetFile.xml, to the new windows 10 format called, filename.xml
ConvertTo-ProcessMitigationPolicy -EMETFilePath emetFile.xml -OutputFilePath filename.xml
Make sure things are working
- Apply a mitigation setting: a. Launch PowerShell as an admin and run Set—ProcessMitigation –Name iexplore.exe –Enable DisallowChildProcessCreation
- Validate that the setting is correctly applied: a. Open Windows Defender Security Center -> App & browser control b. Scroll to the bottom and under Exploit protection, click Exploit protection settings and navigate to the Program settings pivot c. Scroll down to iexplore.exe, click on it and click Edit d. Find the Do not allow child processes setting and make sure that Override System settings and On are set
- Validate that Internet Explorer won’t run: a. Try launching iexplore.exe via the run dialog b. An IE frame should appear and then close
- Validate that event viewer reports that the mitigation fired: a. Open Event Viewer b. Navigate to Applications and Services Log -> Microsoft -> Windows -> Security-Mitigations -> Kernel Mode c. Check for the following entry for Internet Explorer (event ID 4)
Process '\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe' (PID 4692) was blocked from creating a child process 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' with command line '"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:75009 /prefetch:2'.
- Undo the mitigation setting: a. Open Windows Defender Security Center -> App & browser control b. Scroll to the bottom and under Exploit protection, click on Exploit protection settings and navigate to the Program settings pivot c. Scroll down to iexplore.exe, click on it and click Edit d. Find the **Do not allow child processes **setting and toggle the On to Off e. Click Apply
- Validate that Internet Explorer runs: a. Try launching iexplore.exe via the run dialog b. IE should open as expected
Converting and Applying an EMET config:
- Export the existing EMET configuration. This can be done from the "Export" button in the GUI, or by running the command: emet_conf.exe –export emetConfig.xml
- In an elevated PowerShell window, convert the exported configuration with: ConvertTo-ProcessMitigationPolicy -EMETFilePath emetConfig.xml -OutputFilePath win10Config.xml
- Note that this may give you some warnings, but these should be safe to ignore.
- Apply the new configuration: from an elevated PowerShell window run **Set-ProcessMitigation -RegistryConfigFilePath win10Config.xml **
- From here you can check or edit the settings in the new interface in the Windows Defender Security Center or with Get-ProcessMitigation (this command by itself will output the entire current state of the mitigations to the shell), and Set-ProcessMitigation respectively.
Managing Exploit Protection through Group Policy
- Launch Group Policy Management Console (gpmc.msc) and from within and existing or new GPO navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection and open the policy named Use a common set of exploit protection settings.
- Enable the setting as seen below and point to an accessible location for the client machines to the recently created XML.
- Apply the new GP to targeted machines by direction OU membership, Security Group or WMI filter.