You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/evaluate-exploit-protection.md
+69-4Lines changed: 69 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- tier2
16
16
- mde-asr
17
17
search.appverid: met150
18
-
ms.date: 11/15/2024
18
+
ms.date: 11/21/2024
19
19
---
20
20
21
21
# Evaluate exploit protection
@@ -37,7 +37,7 @@ In audit, you can see how mitigation works for certain apps in a test environmen
37
37
38
38
Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection.
39
39
40
-
#### What kinds of Software shouldn't be protected by exploit protection?
40
+
#### What kinds of software shouldn't be protected by exploit protection?
41
41
42
42
- Anti-malware and intrusion prevention or detection software
43
43
- Debuggers
@@ -55,6 +55,40 @@ Services
55
55
- System services
56
56
- Network services
57
57
58
+
## Exploit protection mitigations enabled by default
59
+
60
+
| Mitigation | Enabled by default |
61
+
| -------- | -------- |
62
+
| Data Execution Prevention (DEP) | 64-bit and 32-bit applications |
Instead of using Exploit Protection for Office applications such as Outlook, Word, Excel, PowerPoint, and OneNote, consider using a more modern approach to prevent their misuse: Attack Surface Reduction rules (ASR rules):
79
+
80
+
-[Block executable content from email client and webmail ](attack-surface-reduction-rules-reference.md#block-executable-content-from-email-client-and-webmail)
81
+
-[Block Office applications from creating executable content](attack-surface-reduction-rules-reference.md#block-office-applications-from-creating-executable-content)
82
+
-[Block all Office applications from creating child processes](attack-surface-reduction-rules-reference.md#block-all-office-applications-from-creating-child-processes)
83
+
-[Block Office communication application from creating child processes](attack-surface-reduction-rules-reference.md#block-office-communication-application-from-creating-child-processes)
84
+
-[Block Office applications from injecting code into other processes](attack-surface-reduction-rules-reference.md#block-office-applications-from-injecting-code-into-other-processes)
85
+
-[Block execution of potentially obfuscated scripts](attack-surface-reduction-rules-reference.md#block-execution-of-potentially-obfuscated-scripts)
86
+
-[Block Win32 API calls from Office macros](attack-surface-reduction-rules-reference.md#block-win32-api-calls-from-office-macros)
87
+
88
+
For Adobe Reader use the following ASR rule:
89
+
90
+
• [Block Adobe Reader from creating child processes](attack-surface-reduction-rules-reference.md#block-adobe-reader-from-creating-child-processes)
91
+
58
92
## Application compatibility list
59
93
60
94
The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues can introduced when you apply certain add-ins or other components to the standard software.
@@ -69,7 +103,7 @@ The following table lists specific products that have compatibility issues with
69
103
| DropBox | EAF |
70
104
| Excel Power Query, Power View, Power Map and PowerPivot | EAF |
71
105
| Google Chrome | EAF+ |
72
-
| Immidio Flex+ |Cell 4|
106
+
| Immidio Flex+ |EAF|
73
107
| Microsoft Office Web Components (OWC) | System DEP=AlwaysOn |
74
108
| Microsoft PowerPoint | EAF |
75
109
| Microsoft Teams | EAF+ |
@@ -82,7 +116,38 @@ The following table lists specific products that have compatibility issues with
82
116
83
117
ǂ EMET mitigations might be incompatible with Oracle Java when they're run by using settings that reserve a large chunk of memory for the virtual machine (that is, by using the -Xms option).
84
118
85
-
## Enable exploit protection for testing
119
+
## Enable exploit protection system settings for testing
120
+
121
+
These Exploit Protection system settings are enabled by default on Windows 10 and later, Windows Server 2019 and later, and on Windows Server version 1803 core edition and later.
122
+
123
+
| System settings | Setting |
124
+
| -------- | -------- |
125
+
| Control flow guard (CFG) | Use default (On) |
126
+
| Data Execution Prevention (DEP) | Use default (On) |
127
+
| Force randomization for images (Mandatory ASRL) | Use default (On) |
## Enable exploit protection program settings for testing
148
+
149
+
> [!TIP]
150
+
> We highly recommend reviewing the modern approach for vulnerability mitigations, which is to use [Attack Surface Reduction rules (ASR rules)](attack-surface-reduction.md).
86
151
87
152
You can set mitigations in a testing mode for specific programs by using the Windows Security app or Windows PowerShell.
| Disable Win32k system calls | ExploitGuardWin32SystemCallAudited <br/> ExploitGuardWin32SystemCallBlocked <br/>|
78
+
79
+
63
80
## Review exploit protection events in Windows Event Viewer
64
81
65
82
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:<br/><br/>
@@ -126,7 +143,6 @@ The table in this section indicates the availability and support of native mitig
126
143
|Validate image dependency integrity | Yes | No |
127
144
128
145
> [!NOTE]
129
-
130
146
> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10 and Windows 11, which other EMET advanced settings are enabled by default, as part of enabling the anti-ROP mitigations for a process. For more information on how Windows 10 employs existing EMET technology, see the [Mitigation threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit).
Copy file name to clipboardExpand all lines: defender-vulnerability-management/defender-vulnerability-management-faq.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -130,7 +130,7 @@ The [Windows authenticated scan](windows-authenticated-scan.md) deprecation proc
130
130
131
131
### Why is this product being deprecated?
132
132
133
-
The deprecation is to streamline offerings and focus on features that provide greater value to customers. This change allows our teams to allocate resources to innovations that better meet customer needs. We understand transitions can be challenging, and we're here to support you throughout the process. Let us know if you have any questions or need assistance.
133
+
We're deprecating Windows authenticated scan to allow our teams to allocate resources to other product innovations. We understand transitions can be challenging, and we're here to support you throughout the process. Let us know if you have any questions or need assistance with this change.
134
134
135
135
### When will the product be officially deprecated?
title: DeviceBaselineComplianceAssessment table in the advanced hunting schema
3
+
description: Learn about the baseline compliance assessment snapshot, indicating the status of various security configurations related to baseline profiles on devices in Microsoft Defender XDR.
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35
+
36
+
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
37
+
38
+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39
+
40
+
| Column name | Data type | Description |
41
+
|-------------|-----------|-------------|
42
+
|`DeviceId`|`string`| Unique identifier for the device in the service |
43
+
|`DeviceName`|`string`| Fully qualified domain name (FQDN) of the device |
44
+
|`OSPlatform`|`string`| Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
45
+
|`OSVersion`|`string`| Version of the operating system running on the device |
46
+
|`ConfigurationId`|`string`| Unique identifier for a specific configuration |
47
+
|`ProfileId`|`string`| Unique identifier for the profile |
48
+
|`IsCompliant`|`boolean`| Indicates whether the device that initiated the event is compliant or not |
49
+
|`IsApplicable`|`boolean`| Indicates whether the configuration or policy is applicable |
50
+
|`Source`|`dynamic`| The registry path or other location used to determine the current device setting |
51
+
|`RecommendedValue`|`dynamic`| Set of expected values for the current device setting to be compliant |
52
+
|`CurrentValue`|`dynamic`| Set of detected values found on the device |
53
+
|`IsExempt`|`boolean`| Indicates whether the device is exempt from having the baseline configuration |
54
+
55
+
56
+
## Related topics
57
+
58
+
-[Proactively hunt for threats](advanced-hunting-overview.md)
59
+
-[Learn the query language](advanced-hunting-query-language.md)
60
+
-[Understand the schema](advanced-hunting-schema-tables.md)
61
+
-[Apply query best practices](advanced-hunting-best-practices.md)
62
+
-[Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
title: DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema
3
+
description: Learn about the various security configurations used by baseline compliance to assess devices in the DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema.
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35
+
36
+
The `DeviceBaselineComplianceAssessmentKB` table in the advanced hunting schema contains information about various security configurations used by baseline compliance to assess devices.
37
+
38
+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39
+
40
+
| Column name | Data type | Description |
41
+
|-------------|-----------|-------------|
42
+
|`ConfigurationId`|`string`| Unique identifier for a specific configuration |
43
+
|`ConfigurationName`|`string`| Display name of the configuration |
44
+
|`ConfigurationDescription`|`string`| Description of the configuration |
45
+
|`ConfigurationRationale`|`string`| Description of any associated risks and rationale behind the configuration |
46
+
|`ConfigurationCategory`|`string`| Category or grouping to which the configuration belongs |
47
+
|`BenchmarkProfileLevels`|`dynamic`| List of benchmark compliance levels for which the configuration is applicable |
48
+
|`CCEReference`|`string`| Unique Common Configuration Enumeration (CCE) identifier for the configuration |
49
+
|`RemediationOptions`|`string`| Recommended actions to reduce or address any associated risks |
50
+
|`ConfigurationBenchmark`|`string`| Industry benchmark recommending the configuration |
51
+
|`Source`|`dynamic`| The registry path or other location used to determine the current device setting |
52
+
|`RecommendedValue`|`dynamic`| Set of expected values for the current device setting to be compliant |
0 commit comments