Exploit Protection¶
Exploit protection is a set of system-wide mitigations that make memory-corruption bugs much harder to turn into working attacks. They're on by default. An image can turn them off, and there's no visible symptom when that happens.
Where it is¶
Windows Security → App & browser control → Exploit protection settings → System settings tab.
Every entry should read On by default or On.
| Mitigation | What it does |
|---|---|
| Control flow guard (CFG) | Checks that indirect calls go to expected places |
| Data Execution Prevention (DEP) | Refuses to run code from memory marked as data, which is where most injected code lands |
| Force randomization for images (Mandatory ASLR) | Loads programs at unpredictable addresses so an exploit can't know where to jump |
| Randomize memory allocations (Bottom-up ASLR) | Same, for allocations |
| High-entropy ASLR | More randomness for 64-bit programs |
| Validate exception chains (SEHOP) | Blocks a classic exploit technique |
| Validate heap integrity | Terminates a process when its heap is corrupted instead of letting it continue |
Check with PowerShell¶
Get-ProcessMitigation -System
Long output. The parts to read:
DEP:
Enable : NOTSET
...
Heap:
TerminateOnError : NOTSET
NOTSET means the Windows default, which is on. ON is on. OFF is the problem.
Turn them back on¶
Set-ProcessMitigation -System -Enable DEP, SEHOP, TerminateOnError, BottomUp, HighEntropy, CFG
Or in the GUI, set each dropdown to On by default. A restart is needed for some to take effect.
Verify¶
Get-ProcessMitigation -System | Select -ExpandProperty DEP
Get-ProcessMitigation -System | Select -ExpandProperty Heap
Neither should show OFF.
Example¶
Get-ProcessMitigation -System shows DEP: Enable: OFF. Any buffer overflow in any program on the machine is now much easier to exploit. Re-enable it and restart.
Try it¶
- Open Exploit protection in Windows Security and read the system settings. Set DEP to always on and find the registry value.
- Export the settings with
Get-ProcessMitigation -RegistryConfigFilePath, open the XML, and look at what's there.
Build it¶
Keep the exported XML from a hardened image; Set-ProcessMitigation -PolicyFilePath applies it to the next one after you've read it.