Rediger

Exploit protection (EP) demonstrations

  • Gælder for: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Business, Microsoft Defender for Individuals, Microsoft Defender Antivirus

Overview

This article walks you through demonstration scenarios for configuring Exploit Protection, applying mitigation settings, and converting existing EMET profiles in Microsoft Defender for Endpoint.

Exploit Protection automatically applies exploit mitigation settings system wide and on individual apps. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection.

Prerequisites

  • Windows client devices must be running Windows 11 or Windows 10 1709 build 16273 or newer.
  • Windows server devices must be running Windows Server 2016 and later or Azure Stack HCI OS, version 23H2 and later.

Set up the demo environment

  1. Apply the process mitigation policy from the XML configuration file by running the following PowerShell command:

    Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml

  2. To view usage and parameter information for customizing or troubleshooting the policy application, run the following command:

    Set-ProcessMitigation –help

  3. Verify that the mitigation policy was applied successfully by listing the current process mitigation settings:

     Get-ProcessMitigation

Sample XML file for exploit protection settings

EP xml config file (right select, "save target as")

Exploit protection demonstration scenarios

The following scenarios show how to convert and apply Exploit Protection settings.

Scenario 1: Convert EMET xml to Exploit Protection settings

Use the following steps to convert an EMET XML configuration file to Exploit Protection settings:

  1. Convert EMET to xml, run PowerShell command:

    ConvertTo-ProcessMitigationPolicy

  2. Apply settings using the XML file generated by ConvertTo-ProcessMitigationPolicy, run PowerShell command:

    Set-ProcessMitigation -PolicyFilePath

  3. Confirm settings were applied, run PowerShell command:

    Get-ProcessMitigation

  4. Review the event log for application compatibility

Scenario 2: Apply selfhost xml to Exploit Protection settings

Follow these steps to apply a self-hosted XML configuration to Exploit Protection settings:

  1. Download our EP xml config file (right select, "save target as") or use your own.

  2. Apply settings, run PowerShell command:

    Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml

  3. Confirm settings were applied, run PowerShell command:

    Get-ProcessMitigation

  4. Review the event log for application compatibility.

Related content

Exploit Protection documentation

Microsoft Defender for Endpoint - demonstration scenarios

  • Last updated on