Skip to content

defender-endpoint-demonstration-exploit-protection.md

Latest commit

 

History

History
106 lines (72 loc) · 2.83 KB

defender-endpoint-demonstration-exploit-protection.md

File metadata and controls

106 lines (72 loc) · 2.83 KB

title: Microsoft Defender for Endpoint Exploit protection (EP) demonstrations description: See how Exploit Protection automatically applies many exploit mitigation settings system wide and on individual apps. search.appverid: met150 ms.service: defender-endpoint ms.author: lwainstein author: limwainstein ms.localizationpriority: medium manager: bagol audience: ITPro ms.collection:

  • m365-security
  • tier2
  • demo ms.topic: how-to ms.subservice: asr ms.date: 03/04/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2
    • Microsoft Defender for Business
    • Microsoft Defender for Individuals
    • Microsoft Defender Antivirus

Exploit protection (EP) demonstrations

Exploit Protection automatically applies exploit mitigation settings system wide and on individual apps. Many of the features in the Enhanced Mitigation Experience Toolkit (EMET) have been included in Exploit Protection, and you can convert and import existing EMET configuration profiles into Exploit Protection.

Prerequisites

  • Windows client devices must be running Windows 11 or Windows 10 1709 build 16273 or newer.
  • Windows server devices must be running Windows Server 2016 and later or Azure Stack HCI OS, version 23H2 and later.

Setup

  1. Run PowerShell commands:

    Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml
    Set-ProcessMitigation –help

  2. Verify configuration

     Get-ProcessMitigation

Sample xml file

EP xml config file (right select, "save target as")

Scenario

Scenario 1: Convert EMET xml to Exploit Protection settings

  1. Convert EMET to xml, run PowerShell command:

    ConvertTo-ProcessMitigationPolicy

  2. Apply settings, run PowerShell command: use the XML from the prior step

    Set-ProcessMitigation -PolicyFilePath

  3. Confirm settings were applied, run PowerShell command:

    Get-ProcessMitigation

  4. Review the event log for application compatibility

Scenario 2: Apply selfhost xml to Exploit Protection settings

  1. Download our EP xml config file (right select, "save target as") or use your own.

  2. Apply settings, run PowerShell command:

    Set-ProcessMitigation -PolicyFilePath ProcessMitigation.xml

  3. Confirm settings were applied, run PowerShell command:

    Get-ProcessMitigation

  4. Review the event log for application compatibility.

See also

Exploit Protection

Microsoft Defender for Endpoint - demonstration scenarios