Exploit protection (EP) demonstrations

Exploit Protection automatically applies exploit mitigation settings system wide and on individual apps. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection.

Prerequisites

• Windows client devices must be running Windows 11 or Windows 10 1709 build 16273 or newer.
• Windows server devices must be running Windows Server 2016 and later or Azure Stack HCI OS, version 23H2 and later.

Setup

1. Run PowerShell commands:

   Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml
   

   Set-ProcessMitigation –help
   

2. Verify configuration

    Get-ProcessMitigation
   

Sample xml file

EP xml config file (right select, "save target as")

Scenario

Scenario 1: Convert EMET xml to Exploit Protection settings

1. Convert EMET to xml, run PowerShell command:

   ConvertTo-ProcessMitigationPolicy
   

2. Apply settings, run PowerShell command: use the XML from the prior step

   Set-ProcessMitigation -PolicyFilePath
   

3. Confirm settings were applied, run PowerShell command:

   Get-ProcessMitigation
   

4. Review the event log for application compatibility

Scenario 2: Apply selfhost xml to Exploit Protection settings

1. Download our EP xml config file (right select, "save target as") or use your own.

2. Apply settings, run PowerShell command:

   Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml
   

3. Confirm settings were applied, run PowerShell command:

   Get-ProcessMitigation
   

4. Review the event log for application compatibility.

See also

Exploit Protection

Microsoft Defender for Endpoint - demonstration scenarios