mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-21 05:13:40 +00:00
116 lines
5.5 KiB
Markdown
116 lines
5.5 KiB
Markdown
---
|
|
title:
|
|
keywords:
|
|
search.product: eADQiWindows 10XVcnh
|
|
ms.pagetype: security
|
|
ms.prod: w10
|
|
ms.mktglfcycl: manage
|
|
ms.sitesec: library
|
|
ms.pagetype: security
|
|
localizationpriority: medium
|
|
author: iaanw
|
|
ms.author: iawilt
|
|
---
|
|
|
|
|
|
|
|
# Protect devices from exploits with Windows Defender Exploit Guard
|
|
|
|
|
|
**Applies to:**
|
|
|
|
- Windows 10 Insider Preview
|
|
|
|
**Audience**
|
|
|
|
- Enterprise security administrators
|
|
|
|
|
|
**Manageability available with**
|
|
|
|
- Windows Defender Security Center app
|
|
- Group Policy
|
|
- PowerShell
|
|
- Configuration service providers for mobile device management
|
|
|
|
|
|
Exploit Protection automatically applies a number of exploit mitigation techniques on both [the operating system processes](configure-system-exploit-protection.md) and on [individual apps](configure-app-exploit-protection.md).
|
|
|
|
It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
|
|
|
|
Exploit Protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection).
|
|
|
|
You [configure these settings using the Windows Defender Security Center app or PowerShell](customize-exploit-protection.md) on an individual machine, and then [export the configuration as an XML file that you can deploy to other machines](import-export-exploit-protection-emet-xml.md). You can use Group Policy to distribute the XML file to multiple devices at once.
|
|
|
|
You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Exploit Protection would impact your organization if it were enabled.
|
|
|
|
Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection.
|
|
|
|
>[!IMPORTANT]
|
|
>If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit Protection in Windows 10.
|
|
|
|
|
|
|
|
## Requirements
|
|
|
|
The following requirements must be met before Exploit Protection will work:
|
|
|
|
Windows 10 version | Windows Defender Advanced Threat Protection
|
|
-|-
|
|
Insider Preview build 16232 or later (dated July 1, 2017 or later) | For full reporting you need a license for [Windows Defender ATP](../windows-defender-atp/windows-defender-advanced-threat-protection.md)
|
|
|
|
|
|
## Review Exploit Protection events in Windows Event Viewer
|
|
|
|
You can review the Windows event log to see events there are created when Exploit Protection blocks (or audits) an app:
|
|
|
|
1. Download the [Exploit Guard Evaluation Package](#) and extract the file *ep-events.xml* to an easily accessible location on the machine.
|
|
|
|
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
|
|
|
3. On the left panel, under **Actions**, click **Import custom view...**
|
|
|
|
4. Navigate to where you extracted *ep-events.xml* and select it. Alternatively, [download the XML directly](scripts/ep-events.xml).
|
|
|
|
4. Click **OK**.
|
|
|
|
5. This will create a custom view that filters to only show the following events related to Controlled Folder Access:
|
|
|
|
Provider/source | Event ID | Description
|
|
-|:-:|-
|
|
Security-Mitigations | 1 | ACG audit
|
|
Security-Mitigations | 2 | ACG enforce
|
|
Security-Mitigations | 3 | Do not allow child processes audit
|
|
Security-Mitigations | 4 | Do not allow child processes block
|
|
Security-Mitigations | 5 | Block low integrity images audit
|
|
Security-Mitigations | 6 | Block low integrity images block
|
|
Security-Mitigations | 7 | Block remote images audit
|
|
Security-Mitigations | 8 | Block remote images block
|
|
Security-Mitigations | 9 | Disable win32k system calls audit
|
|
Security-Mitigations | 10 | Disable win32k system calls block
|
|
Security-Mitigations | 11 | Code integrity guard audit
|
|
Security-Mitigations | 12 | Code integrity guard block
|
|
Security-Mitigations | 13 | EAF audit
|
|
Security-Mitigations | 14 | EAF enforce
|
|
Security-Mitigations | 15 | EAF+ audit
|
|
Security-Mitigations | 16 | EAF+ enforce
|
|
Security-Mitigations | 17 | IAF audit
|
|
Security-Mitigations | 18 | IAF enforce
|
|
Security-Mitigations | 19 | ROP StackPivot audit
|
|
Security-Mitigations | 20 | ROP StackPivot enforce
|
|
Security-Mitigations | 21 | ROP CallerCheck audit
|
|
Security-Mitigations | 22 | ROP CallerCheck enforce
|
|
Security-Mitigations | 23 | ROP SimExec audit
|
|
Security-Mitigations | 24 | ROP SimExec enforce
|
|
WER-Diagnostics | 5 | CFG Block
|
|
Win32K | 260 | Untrusted Font
|
|
|
|
|
|
## In this section
|
|
|
|
Topic | Description
|
|
---|---
|
|
[Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) | Many of the features in the EMET are now included in Exploit Protection. This topic identifies those features and explains how the features have changed or evolved.
|
|
[Evaluate Exploit Protection](evaluate-exploit-protection.md) | Undertake a demo scenario to see how Exploit Protection mitigations can protect your network from malicious and suspicious behavior.
|
|
[Enable Exploit Protection](enable-exploit-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage Exploit Protection in your network. See how to configure mitigations for the operating system and for individual apps, and how to export, import, and deploy the settings across your organization. You can also convert an existing EMET configuration profile and import it into Exploit Protection.
|