Windows 10: Moving Beyond EMET II – Windows Defender Exploit Guard

Source: Moving Beyond EMET II - Windows Defender Exploit Guard Defense

:)

 

Windows Defender

No AV/Antimalware app comes with an ironclad guarantee – because no single app can cover the entire spectrum of online threats. But not so long ago, Windows Defender's level of protection was used as a “baseline” for comparing the protection offered
by third-party AV apps. That’s no longer the case, and once Windows 10 is updated to the Fall Creators Update, Windows Defender should be sufficient for most users. Specifically, the last two version updates have made a quantum leap in Defender’s level of
protection against ransomware and zero-day threats by including these features:

Block at First Sight (Seen):

Windows Defender can now immediately block suspicious or unknown files; and then automatically analyze a sample and generate a signature within a matter of seconds

Enable Block at First Sight to detect malware in seconds

Windows Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware


We can also use PowerShell to upgrade the default settings for the Block at First Sight feature:

You can increase the default Cloud Block Level by running one of these commands at the elevated PowerShell Prompt:

Set-MpPreference -CloudBlockLevel High

Set-MpPreference -CloudBlockLevel HighPlus

Set-MpPreference -CloudBlockLevel ZeroTolerance

And you can also increase the allotted analysis time by running this command at the elevated PowerShell prompt:

Set-MpPreference -CloudExtendedTimeout 50

Windows Defender Exploit Guard:

The exploit protection features that were previously provided by EMET are now integrated into Windows 10.

Apply mitigations to help prevent attacks through vulnerabilities

Moving Beyond EMET II – Windows Defender Exploit Guard

Attack Surface Reduction:

We also have the ability to add Attack Surface Reduction rules with PowerShell in Version 1709:

Enable ASR rules individually to protect your organization

Windows Defender Exploit Guard: Reduce the attack surface against next-generation malware

For example, here’s the first rule that I set up immediately by running this line at the elevated PowerShell prompt

Rule: Block JavaScript or VBScript from launching downloaded executable content:

Set-MpPreference -AttackSurfaceReductionRules_Ids
D3E037E1-3EB8-44C8-A917-57927947596D -AttackSurfaceReductionRules_Actions Enabled

Then to add additional rules, we use the Add-MpPreference command:

Rule: Block executable content from email client and webmail:

Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions
Enabled





Controlled Folder Access:

Windows document folders are now protected by default, and we can add this ransomware protection to additional folders, as well as whitelist trusted applications in order to allow them access.

Help prevent ransomware and threats from encrypting and changing files

Stopping ransomware where it counts: Protecting your data with Controlled folder access

PUA Protection:

Windows Defender has actually been able to detect and block Potentially Unwanted Applications for some time now, but many people still don’t know that this feature is disabled by default and needs to be enabled by running this command line at the elevated
PowerShell Prompt:

Set-MpPreference -PUAProtection 1

Then confirm that PUA Protection was enabled by returning the current state for PUAProtection:

$Preferences = Get-MpPreference

$Preferences.PUAProtection

Block Potentially Unwanted Applications with Windows Defender AV


That's enough to convince me that better days are ahead for Windows Defender, and there isn't much doubt that these new features will mitigate the risks associated with ransomware and zero-day threats.

 

Bug? In Windows Defender Exploit Guard.

If we assume that this is just a glitch, then you might be able to reset the Exploit protection defaults by exporting the settings from an unaffected PC (with default settings) and then importing those settings on the affected machines. This looks
to be the backup/restore tool for the Exploit protection settings:

Deploy Exploit protection mitigations across your organization

Export and Import Exploit Protection Settings in Windows 10

 

Thanks for posting that, Shawn. It's included in Insider build 16257.

 

*Thumbs

*Arrow Change Exploit Protection Settings in Windows 10 Windows 10 Security System Tutorials

 

Thanks Shawn...for info plus link for tutorial.

 

Thanks, again. I didn't know that section was in 16332. *Redface