Skip to content

Commit 4740cba

Browse files
committed
Update evaluate-exploit-protection.md
1 parent 969398a commit 4740cba

File tree

1 file changed

+15
-15
lines changed

1 file changed

+15
-15
lines changed

defender-endpoint/evaluate-exploit-protection.md

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
- tier2
1616
- mde-asr
1717
search.appverid: met150
18-
ms.date: 12/18/2020
18+
ms.date: 11/15/2024
1919
---
2020

2121
# Evaluate exploit protection
@@ -35,34 +35,31 @@ In audit, you can see how mitigation works for certain apps in a test environmen
3535

3636
## Generic guidelines
3737

38-
Exploit Protection mitigations work at a very low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they are configured to be protected by using Exploit Protection.
38+
Exploit protection mitigations work at a very low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they are configured to be protected by using exploit protection.
3939

40-
#### The following list of the kinds of software that should not be protected by using Exploit Protection:
40+
#### What kinds of Software should not be protected by exploit protection?
4141

4242
- Anti-malware and intrusion prevention or detection software
43-
4443
- Debuggers
45-
4644
- Software that handles digital rights management (DRM) technologies (that is, video games)
47-
4845
- Software that use anti-debugging, obfuscation, or hooking technologies
4946

50-
#### What type of applications should you consider enabling Exploit Protection?
47+
#### What type of applications should you consider enabling exploit protection?
5148

5249
Applications that receive or handle untrusted data.
5350

54-
#### What type of processes are out of scope for Exploit Protection?
51+
#### What type of processes are out of scope for exploit protection?
5552

5653
Services
5754

5855
- System services
59-
6056
- Network services
6157

6258
## Application compatibility list
63-
The following is a list of specific products that have compatibility issues in regard to the mitigations that are offered by Exploit Protection. You must disable specific incompatible mitigations if you want to protect the product by using Exploit Protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues introduction may by introduced when you apply certain add-ins or additional components to the standard software.
6459

65-
| Product | Exploit Protection mitigation |
60+
The following is a list of specific products that have compatibility issues in regard to the mitigations that are offered by exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues introduction may by introduced when you apply certain add-ins or additional components to the standard software.
61+
62+
| Product | Exploit protection mitigation |
6663
| -------- | -------- |
6764
| .NET 2.0/3.5 | EAF/IAF |
6865
| 7-Zip Console/GUI/File Manager | EAF |
@@ -97,10 +94,12 @@ You can set mitigations in a testing mode for specific programs by using the Win
9794

9895
3. Go to **Program settings** and choose the app you want to apply protection to:
9996

100-
1. If the app you want to configure is already listed, select it and then select **Edit**
101-
2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
102-
- Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
103-
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
97+
1. If the app you want to configure is already listed, select it and then select **Edit**.
98+
99+
2. If the app isn't listed at the top of the list select **Add program to customize**. Then, choose how you want to add the app.
100+
101+
- Use **Add by program name** to have the mitigation applied to any running process with that name. Specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
102+
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
104103

105104
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in test mode only. You'll be notified if you need to restart the process, app, or Windows.
106105

@@ -162,4 +161,5 @@ To review which apps would have been blocked, open Event Viewer and filter for t
162161
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
163162
- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
164163
- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md)
164+
165165
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)