6.9 KiB
title, description, keywords, search.product, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, author, ms.author, ms.date
| title | description | keywords | search.product | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.localizationpriority | author | ms.author | ms.date |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| See how Exploit protection works in a demo | See how Exploit protection can prevent suspicious behaviors from occurring on specific apps. | Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigiation | eADQiWindows 10XVcnh | security | w10 | manage | library | security | medium | andreabichsel | v-anbic | 05/30/2018 |
Evaluate Exploit protection
Applies to:
- Windows 10, version 1709 and later
- Windows Server 2016
Audience
- Enterprise security administrators
Manageability available with
- Windows Defender Security Center app
- Group Policy
- PowerShell
Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
Many of the features that are part of the Enhanced Mitigation Experience Toolkit (EMET) are included in Exploit protection.
This topcs helps you evaluate Exploit protection. See the Exploit protection topic for more information on what Exploit protection does and how to configure it for real-world deployment.
Note
This topic uses PowerShell cmdlets to make it easy to enable the feature and test it. For instructions on how to use Group Policy and Mobile Device Management (MDM to deploy these settings across your network, see the main Exploit protection topic .
Tip
You can also visit the Windows Defender Testground website at demo.wd.microsoft.com to confirm the feature is working and see how it works.
Enable and validate an Exploit protection mitigation
For this demo you will enable the mitigation that prevents child processes from being created. You'll use Internet Explorer as the parent app.
First, enable the mitigation using PowerShell, and then confirm that it has been applied in the Windows Defender Security Center app:
-
Type powershell in the Start menu, right click Windows PowerShell and click Run as administrator
-
Enter the following cmdlet:
Set-ProcessMitigation -Name iexplore.exe -Enable DisallowChildProcessCreation -
Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for Defender.
-
Click the App & browser control tile (or the app icon on the left menu bar) and then Exploit protection settings at the bottom of the screen.
-
Go to the Program settings section, scroll down, click iexplore.exe, and then Edit.
-
Find the Do not allow child processes setting and make sure that Override System settings is enabled and the switch is set to On.
Now that you know the mitigation has been enabled, you can test to see if it works and what the experience would be for an end user:
-
Type run in the Start menu and press Enter to open the run dialog box.
-
Type iexplore.exe and press Enter or click OK to attempt to open Internet Explorer.
-
Internet Explorer should briefly open and then immediately shut down again, indicating that the mitigation was applied and prevented Internet Explorer from opening a child process (its own process).
Lastly, we can disable the mitigation so that Internet Explorer works properly again:
-
Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for Defender.
-
Click the App & browser control tile (or the app icon on the left menu bar) and then Exploit protection settings at the bottom of the screen.
-
Go to the Program settings section, scroll down, click iexplore.exe, and then Edit.
-
Find the Do not allow child processes setting and set the switch to Off. Click Apply
-
Validate that Internet Explorer runs by running it from the run dialog box again. It should open as expected.
Review Exploit protection events in Windows Event Viewer
You can now review the events that Exploit protection sent to the Windows Event log to confirm what happened. You can use the custom view below or locate them manually.
-
Download the Exploit Guard Evaluation Package and extract the file ep-events.xml to an easily accessible location on the machine.
-
Type Event viewer in the Start menu to open the Windows Event Viewer.
-
On the left panel, under Actions, click Import custom view...
-
Navigate to where you extracted ep-events.xml and select it. Alternatively, copy the XML directly.
-
Click OK.
-
This will create a custom view that filters to only show the following events related to Exploit protection, which are all listed in the Exploit protection topic.
-
The specific event to look for in this demo is event ID 4, which should have the following or similar information:
Process '\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe' (PID 4692) was blocked from creating a child process 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' with command line '"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:75009 /prefetch:2'.
Use audit mode to measure impact
As with other Windows Defender EG features, you can enable Exploit protection in audit mode. You can enable audit mode for individual mitigations.
This lets you see a record of what would have happened if you had enabled the mitigation.
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious or malicious events generally occur over a certain period.
See the PowerShell reference section in the Customize Exploit protection topic for a list of which mitigations can be audited and instructions on enabling the mode.
For further details on how audit mode works, and when you might want to use it, see the audit Windows Defender Exploit Guard topic.