17 KiB
title, keywords, description, search.product, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, author, ms.author, ms.date, ms.reviewer, manager
| title | keywords | description | search.product | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.localizationpriority | author | ms.author | ms.date | ms.reviewer | manager |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apply mitigations to help prevent attacks through vulnerabilities | mitigations, vulnerabilities, vulnerability, mitigation, exploit, exploits, emet | Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. | eADQiWindows 10XVcnh | security | w10 | manage | library | security | medium | levinec | ellevin | 04/02/2019 | dansimp |
Protect devices from exploits
Applies to:
Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps.
It is part of Windows Defender Exploit Guard. Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server 2016, version 1803.
Tip
You can visit the Windows Defender Testground website at demo.wd.microsoft.com to confirm the feature is working and see how it works.
Exploit protection works best with Microsoft Defender Advanced Threat Protection - which gives you detailed reporting into exploit protection events and blocks as part of the usual alert investigation scenarios.
You can enable exploit protection on an individual machine, and then use Group Policy to distribute the XML file to multiple devices at once.
When a mitigation is encountered on the machine, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
You can also use audit mode to evaluate how exploit protection would impact your organization if it were enabled.
Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to exploit protection on Windows 10.
Important
If you are currently using EMET you should be aware that EMET reached end of life on July 31, 2018. You should consider replacing EMET with exploit protection in Windows 10. You can convert an existing EMET configuration file into exploit protection to make the migration easier and keep your existing settings.
Warning
Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using audit mode before deploying the configuration across a production environment or the rest of your network.
Review exploit protection events in Windows Event Viewer
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:
| Provider/source | Event ID | Description |
|---|---|---|
| Security-Mitigations | 1 | ACG audit |
| Security-Mitigations | 2 | ACG enforce |
| Security-Mitigations | 3 | Do not allow child processes audit |
| Security-Mitigations | 4 | Do not allow child processes block |
| Security-Mitigations | 5 | Block low integrity images audit |
| Security-Mitigations | 6 | Block low integrity images block |
| Security-Mitigations | 7 | Block remote images audit |
| Security-Mitigations | 8 | Block remote images block |
| Security-Mitigations | 9 | Disable win32k system calls audit |
| Security-Mitigations | 10 | Disable win32k system calls block |
| Security-Mitigations | 11 | Code integrity guard audit |
| Security-Mitigations | 12 | Code integrity guard block |
| Security-Mitigations | 13 | EAF audit |
| Security-Mitigations | 14 | EAF enforce |
| Security-Mitigations | 15 | EAF+ audit |
| Security-Mitigations | 16 | EAF+ enforce |
| Security-Mitigations | 17 | IAF audit |
| Security-Mitigations | 18 | IAF enforce |
| Security-Mitigations | 19 | ROP StackPivot audit |
| Security-Mitigations | 20 | ROP StackPivot enforce |
| Security-Mitigations | 21 | ROP CallerCheck audit |
| Security-Mitigations | 22 | ROP CallerCheck enforce |
| Security-Mitigations | 23 | ROP SimExec audit |
| Security-Mitigations | 24 | ROP SimExec enforce |
| WER-Diagnostics | 5 | CFG Block |
| Win32K | 260 | Untrusted Font |
Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard
Important
If you are currently using EMET, you should be aware that EMET reached end of life on July 31, 2018. You should consider replacing EMET with exploit protection in Microsoft Defender ATP.
You can convert an existing EMET configuration file into exploit protection to make the migration easier and keep your existing settings.
This section compares exploit protection in Microsoft Defender ATP with the Enhance Mitigation Experience Toolkit (EMET) for reference. The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
| Windows Defender Exploit Guard | EMET | |
|---|---|---|
| Windows versions | [!includeCheck mark yes] All versions of Windows 10 starting with version 1709 |
[!includeCheck mark yes] Windows 8.1; Windows 8; Windows 7 Cannot be installed on Windows 10, version 1709 and later |
| Installation requirements | Windows Security in Windows 10 (no additional installation required) Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. |
Available only as an additional download and must be installed onto a management device |
| User interface | Modern interface integrated with the Windows Security app | Older, complex interface that requires considerable ramp-up training |
| Supportability | [!includeCheck mark yes] Dedicated submission-based support channel[1] Part of the Windows 10 support lifecycle |
[!includeCheck mark no] Ends after July 31, 2018 |
| Updates | [!includeCheck mark yes] Ongoing updates and development of new features, released twice yearly as part of the Windows 10 semi-annual update channel |
[!includeCheck mark no] No planned updates or development |
| Exploit protection | [!includeCheck mark yes] All EMET mitigations plus new, specific mitigations (see table) Can convert and import existing EMET configurations |
[!includeCheck mark yes] Limited set of mitigations |
| Attack surface reduction[2] | [!includeCheck mark yes] Helps block known infection vectors Can configure individual rules |
[!includeCheck mark yes] Limited ruleset configuration only for modules (no processes) |
| Network protection[2] | [!includeCheck mark yes] Helps block malicious network connections |
[!includeCheck mark no] Not available |
| Controlled folder access[2] | [!includeCheck mark yes] Helps protect important folders Configurable for apps and folders |
[!includeCheck mark no] Not available |
| Configuration with GUI (user interface) | [!includeCheck mark yes] Use Windows Security app to customize and manage configurations |
[!includeCheck mark yes] Requires installation and use of EMET tool |
| Configuration with Group Policy | [!includeCheck mark yes] Use Group Policy to deploy and manage configurations |
[!includeCheck mark yes] Available |
| Configuration with shell tools | [!includeCheck mark yes] Use PowerShell to customize and manage configurations |
[!includeCheck mark yes] Requires use of EMET tool (EMET_CONF) |
| System Center Configuration Manager | [!includeCheck mark yes] Use Configuration Manager to customize, deploy, and manage configurations |
[!includeCheck mark no] Not available |
| Microsoft Intune | [!includeCheck mark yes] Use Intune to customize, deploy, and manage configurations |
[!includeCheck mark no] Not available |
| Reporting | [!includeCheck mark yes] With Windows event logs and full audit mode reporting Full integration with Microsoft Defender Advanced Threat Protection |
[!includeCheck mark yes] Limited Windows event log monitoring |
| Audit mode | [!includeCheck mark yes] Full audit mode with Windows event reporting |
[!includeCheck mark no] Limited to EAF, EAF+, and anti-ROP mitigations |
(1) Requires an enterprise subscription with Azure Active Directory or a Software Assurance ID.
(2) Additional requirements may apply (such as use of Windows Defender Antivirus). See Windows Defender Exploit Guard requirements for more details. Customizable mitigation options that are configured with exploit protection do not require Windows Defender Antivirus.
Mitigation comparison
The mitigations available in EMET are included in Windows Defender Exploit Guard, under the exploit protection feature.
The table in this section indicates the availability and support of native mitigations between EMET and exploit protection.
| Mitigation | Available in Windows Defender Exploit Guard | Available in EMET |
|---|---|---|
| Arbitrary code guard (ACG) | [!includeCheck mark yes] | [!includeCheck mark yes] As "Memory Protection Check" |
| Block remote images | [!includeCheck mark yes] | [!includeCheck mark yes] As "Load Library Check" |
| Block untrusted fonts | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Data Execution Prevention (DEP) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Export address filtering (EAF) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Force randomization for images (Mandatory ASLR) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| NullPage Security Mitigation | [!includeCheck mark yes] Included natively in Windows 10 See Mitigate threats by using Windows 10 security features for more information |
[!includeCheck mark yes] |
| Randomize memory allocations (Bottom-Up ASLR) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Simulate execution (SimExec) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Validate API invocation (CallerCheck) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Validate exception chains (SEHOP) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Validate stack integrity (StackPivot) | [!includeCheck mark yes] | [!includeCheck mark yes] |
| Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!includeCheck mark yes] |
| Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection See Mitigate threats by using Windows 10 security features for more information |
[!includeCheck mark yes] |
| Block low integrity images | [!includeCheck mark yes] | [!includeCheck mark no] |
| Code integrity guard | [!includeCheck mark yes] | [!includeCheck mark no] |
| Disable extension points | [!includeCheck mark yes] | [!includeCheck mark no] |
| Disable Win32k system calls | [!includeCheck mark yes] | [!includeCheck mark no] |
| Do not allow child processes | [!includeCheck mark yes] | [!includeCheck mark no] |
| Import address filtering (IAF) | [!includeCheck mark yes] | [!includeCheck mark no] |
| Validate handle usage | [!includeCheck mark yes] | [!includeCheck mark no] |
| Validate heap integrity | [!includeCheck mark yes] | [!includeCheck mark no] |
| Validate image dependency integrity | [!includeCheck mark yes] | [!includeCheck mark no] |
Note
The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process.
See the Mitigation threats by using Windows 10 security features for more information on how Windows 10 employs existing EMET technology.