You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/android-configure.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: android
17
17
search.appverid: met150
18
-
ms.date: 10/18/2024
18
+
ms.date: 11/22/2024
19
19
---
20
20
21
21
# Configure Defender for Endpoint on Android features
@@ -57,7 +57,7 @@ This feature provides protection against rogue Wi-Fi related threats and rogue c
57
57
58
58
It includes several admin controls to offer flexibility, such as the ability to configure the feature from within the Microsoft Intune admin center and add trusted certificates. Admins can enable [privacy controls](android-configure.md#privacy-controls) to configure the data sent to Defender for Endpoint from Android devices.
59
59
60
-
Network protection in Microsoft Defender for endpoint is disabled by default. Admins can use the following steps to **configure Network protection in Android devices.**
60
+
Network protection in Microsoft Defender for endpoint is enabled by default. Admins can use the following steps to **configure Network protection in Android devices.**
61
61
62
62
In the Microsoft Intune admin center, navigate to Apps > App configuration policies. Create a new App configuration policy.
Copy file name to clipboardExpand all lines: defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Exclude files from Microsoft Defender Antivirus scans based on thei
4
4
ms.service: defender-endpoint
5
5
ms.subservice: ngp
6
6
ms.localizationpriority: medium
7
-
ms.date: 09/10/2024
7
+
ms.date: 11/21/2024
8
8
author: denisebmsft
9
9
ms.author: deniseb
10
10
ms.topic: conceptual
@@ -57,7 +57,7 @@ The following table lists some examples of exclusions based on file extension an
57
57
|Exclusion|Examples|Exclusion list|
58
58
|---|---|---|
59
59
|Any file with a specific extension|All files with the specified extension, anywhere on the machine. <br/><br/> Valid syntax: `.test` and `test`|Extension exclusions|
60
-
|Any file under a specific folder|All files under the `c:\test\sample` folder|File and folder exclusions|
60
+
|Any file or folder under a specific folder|All files and folders under the `c:\test\sample` folder|File and folder exclusions|
61
61
|A specific file in a specific folder|The file `c:\sample\sample.test` only|File and folder exclusions|
62
62
|A specific process|The executable file `c:\test\process.exe`|File and folder exclusions|
Copy file name to clipboardExpand all lines: defender-endpoint/evaluate-exploit-protection.md
+69-4Lines changed: 69 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- tier2
16
16
- mde-asr
17
17
search.appverid: met150
18
-
ms.date: 11/15/2024
18
+
ms.date: 11/21/2024
19
19
---
20
20
21
21
# Evaluate exploit protection
@@ -37,7 +37,7 @@ In audit, you can see how mitigation works for certain apps in a test environmen
37
37
38
38
Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection.
39
39
40
-
#### What kinds of Software shouldn't be protected by exploit protection?
40
+
#### What kinds of software shouldn't be protected by exploit protection?
41
41
42
42
- Anti-malware and intrusion prevention or detection software
43
43
- Debuggers
@@ -55,6 +55,40 @@ Services
55
55
- System services
56
56
- Network services
57
57
58
+
## Exploit protection mitigations enabled by default
59
+
60
+
| Mitigation | Enabled by default |
61
+
| -------- | -------- |
62
+
| Data Execution Prevention (DEP) | 64-bit and 32-bit applications |
Instead of using Exploit Protection for Office applications such as Outlook, Word, Excel, PowerPoint, and OneNote, consider using a more modern approach to prevent their misuse: Attack Surface Reduction rules (ASR rules):
79
+
80
+
-[Block executable content from email client and webmail ](attack-surface-reduction-rules-reference.md#block-executable-content-from-email-client-and-webmail)
81
+
-[Block Office applications from creating executable content](attack-surface-reduction-rules-reference.md#block-office-applications-from-creating-executable-content)
82
+
-[Block all Office applications from creating child processes](attack-surface-reduction-rules-reference.md#block-all-office-applications-from-creating-child-processes)
83
+
-[Block Office communication application from creating child processes](attack-surface-reduction-rules-reference.md#block-office-communication-application-from-creating-child-processes)
84
+
-[Block Office applications from injecting code into other processes](attack-surface-reduction-rules-reference.md#block-office-applications-from-injecting-code-into-other-processes)
85
+
-[Block execution of potentially obfuscated scripts](attack-surface-reduction-rules-reference.md#block-execution-of-potentially-obfuscated-scripts)
86
+
-[Block Win32 API calls from Office macros](attack-surface-reduction-rules-reference.md#block-win32-api-calls-from-office-macros)
87
+
88
+
For Adobe Reader use the following ASR rule:
89
+
90
+
• [Block Adobe Reader from creating child processes](attack-surface-reduction-rules-reference.md#block-adobe-reader-from-creating-child-processes)
91
+
58
92
## Application compatibility list
59
93
60
94
The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues can introduced when you apply certain add-ins or other components to the standard software.
@@ -69,7 +103,7 @@ The following table lists specific products that have compatibility issues with
69
103
| DropBox | EAF |
70
104
| Excel Power Query, Power View, Power Map and PowerPivot | EAF |
71
105
| Google Chrome | EAF+ |
72
-
| Immidio Flex+ |Cell 4|
106
+
| Immidio Flex+ |EAF|
73
107
| Microsoft Office Web Components (OWC) | System DEP=AlwaysOn |
74
108
| Microsoft PowerPoint | EAF |
75
109
| Microsoft Teams | EAF+ |
@@ -82,7 +116,38 @@ The following table lists specific products that have compatibility issues with
82
116
83
117
ǂ EMET mitigations might be incompatible with Oracle Java when they're run by using settings that reserve a large chunk of memory for the virtual machine (that is, by using the -Xms option).
84
118
85
-
## Enable exploit protection for testing
119
+
## Enable exploit protection system settings for testing
120
+
121
+
These Exploit Protection system settings are enabled by default except for the Mandatory Address Space Layout Randomization (ASLR) on Windows 10 and later, Windows Server 2019 and later, and on Windows Server version 1803 core edition and later.
122
+
123
+
| System settings | Setting |
124
+
| -------- | -------- |
125
+
| Control flow guard (CFG) | Use default (On) |
126
+
| Data Execution Prevention (DEP) | Use default (On) |
127
+
| Force randomization for images (Mandatory ASRL) | Use default (Off) |
## Enable exploit protection program settings for testing
148
+
149
+
> [!TIP]
150
+
> We highly recommend reviewing the modern approach for vulnerability mitigations, which is to use [Attack Surface Reduction rules (ASR rules)](attack-surface-reduction.md).
86
151
87
152
You can set mitigations in a testing mode for specific programs by using the Windows Security app or Windows PowerShell.
| Disable Win32k system calls | ExploitGuardWin32SystemCallAudited <br/> ExploitGuardWin32SystemCallBlocked <br/>|
78
+
79
+
63
80
## Review exploit protection events in Windows Event Viewer
64
81
65
82
You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app:<br/><br/>
@@ -126,7 +143,6 @@ The table in this section indicates the availability and support of native mitig
126
143
|Validate image dependency integrity | Yes | No |
127
144
128
145
> [!NOTE]
129
-
130
146
> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10 and Windows 11, which other EMET advanced settings are enabled by default, as part of enabling the anti-ROP mitigations for a process. For more information on how Windows 10 employs existing EMET technology, see the [Mitigation threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit).
0 commit comments