Exploit Protection Policy for Windows 10 & 11

A production-ready, enterprise-tested Exploit Protection (Process Mitigation) repository aligned with current Microsoft Defender for Endpoint Guidelines and DISA STIG benchmarks.

This policy hardens high-risk desktop applications, runtimes, and document viewers against memory corruption, ROP gadget chains, dynamic code injection, and child process abuses—without sacrificing system stability or application compatibility.

Architecture & Profiles

The repository is organized into distinct, purpose-driven profiles:

Profile / File	Target Scope	Mode	Intended Use
EP-W11.xml	Windows 11 Applications	Enforce	Production baseline for Windows 11 endpoints.
EP-W10.xml	Windows 10 (20H1+) Applications	Enforce	Production baseline for Windows 10 endpoints.
EP-W11-Audit.xml	Windows 11 Applications	Audit	Pre-deployment evaluation profile; logs telemetry without blocking.
EP-W10-Audit.xml	Windows 10 Applications	Audit	Pre-deployment evaluation profile; logs telemetry without blocking.
EP-HardenedServices.xml	Windows OS System Services	Overlay	Optional overlay for sensitive OS services (lsass.exe, svchost.exe, etc.); merged on top of baseline.
EP-Reset.xml	System & Applications	Reset	Restores Windows default mitigations and removes policy locks.

System-Wide Mitigations

The baseline policy configures the following system-wide settings in <SystemConfig>:

Control Flow Guard (CFG): Enabled (Standard)
Data Execution Prevention (DEP): Enabled (ATL Thunk Emulation: Disabled)
Address Space Layout Randomization (ASLR):
- Force Relocate Images (Mandatory ASLR): Enabled globally (Enforces relocation of non-dynamic base images; applications with known incompatibilities such as wmplayer.exe, scc.exe, scc64.exe, and MEInfoWin64.exe are exempted per-application).
- Bottom-Up ASLR: Enabled
- High Entropy ASLR (64-bit): Enabled
Structured Exception Handling Overwrite Protection (SEHOP): Enabled
Heap Protection: Terminate on Corruption Enabled
Hardware-enforced Stack Protection (Shadow Stack / CET): Audit Mode
System32 Precedence (PreferSystem32): Enabled globally (Enforces loading system DLLs from %windir%\System32 ahead of application paths to mitigate DLL preloading and search-order hijacking).

Deterministic State & Legacy Mitigation Sanitization

In accordance with Microsoft's Exploit Protection Reference, the following legacy EMET mitigations were deliberately scoped away from system-wide enforcement:

Payload Mitigations (EAF, EAF+, IAF, ROP filters): Microsoft flags global EAF/ROP as deprecated at the system level. When applied globally, EAF crashes 7-Zip, Office add-ins, and anti-cheat modules, and is fundamentally incompatible with Arbitrary Code Guard (ACG).
Strict Handle Checks: Global enforcement causes unhandled STATUS_INVALID_HANDLE crashes in third-party drivers and background processes.
Extension Point Disabling & Non-System Fonts: Global enforcement breaks third-party Input Method Editors (IMEs), accessibility screen readers, and desktop font renderers.
Remote Image Load Restrictions: System-wide remote image blocking breaks execution from network shares (UNC paths). It is retained exclusively on high-risk LOLBINs (rundll32.exe, regsvr32.exe).

Because Set-ProcessMitigation -PolicyFilePath applies settings additively, omitting these mitigations from <SystemConfig> leaves previous kernel flags active in HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\MitigationOptions. The baseline policy files explicitly deactivate them in <SystemConfig> to guarantee a deterministic, safe baseline while enabling them selectively via <AppConfig>.

Modern Attack Surface Reduction (ASR) for Office & Adobe

Microsoft strongly recommends securing productivity applications with Attack Surface Reduction (ASR) rules rather than relying solely on EMET-era payload filters.

The following ASR rules provide defense-in-depth against malicious macro execution and document exploits:

ASR Rule	Rule GUID	Recommended State
Block all Office applications from creating child processes	`D4F940AB-401B-4EFC-AADC-AD5F3C50688A`	Enabled (Block)
Block Adobe Reader from creating child processes	`7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c`	Enabled (Block)
Block Office applications from injecting code into other processes	`7563E30E-7894-4F02-B96A-D19C6237D049`	Enabled (Block)
Block Win32 API calls from Office macros	`92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B`	Enabled (Block)
Block execution of potentially obfuscated scripts	`5beb249e-0e99-4a50-9704-5796db2492f4`	Enabled (Block)

Enabling ASR Rules via PowerShell

# Enable recommended Office & Adobe ASR protection rules
$rules = @(
    'D4F940AB-401B-4EFC-AADC-AD5F3C50688A',
    '7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c',
    '7563E30E-7894-4F02-B96A-D19C6237D049',
    '92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B',
    '5beb249e-0e99-4a50-9704-5796db2492f4'
)
foreach ($id in $rules) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions Enabled
}

Lifecycle: Evaluation, Deployment & Rollback

Step 1: Pre-Deployment Evaluation (Audit Mode)

Deploy the policy in audit mode to collect telemetry without impacting users:

# Auto-detects Windows 10 vs 11 and deploys Audit profile (baseline only)
.\Install-ExploitProtectionPolicy.ps1 -Mode Audit

# Or deploy in Audit mode with Hardened Services merged on top
.\Install-ExploitProtectionPolicy.ps1 -Mode Audit -IncludeHardenedServices

Step 2: Telemetry & Event Log Monitoring

Inspect logged audit events using the built-in diagnostic tool:

# Review exploit protection events from the last 48 hours
.\Get-ExploitProtectionEvents.ps1 -Hours 48

# Inspect only blocked events
.\Get-ExploitProtectionEvents.ps1 -Action Block

# Filter by application name
.\Get-ExploitProtectionEvents.ps1 -ProcessName 'chrome.exe'

Step 3: Production Enforcement

Once verified that no legitimate business software is generating unintended violations:

# Enforce baseline policy (Hardened Services omitted by default)
.\Install-ExploitProtectionPolicy.ps1

# Enforce baseline merged with Hardened Services profile on top
.\Install-ExploitProtectionPolicy.ps1 -IncludeHardenedServices

Step 4: Complete Rollback & Uninstallation

To restore the system completely to standard Windows defaults:

# Purges GPO registry values, clears custom IFEO mitigations, and applies EP-Reset.xml
.\Uninstall-ExploitProtectionPolicy.ps1

Event Log Reference

Exploit Protection events are logged under:

Microsoft-Windows-Security-Mitigations/KernelMode
Microsoft-Windows-Security-Mitigations/UserMode

Event ID (Audit / Block)	Mitigation Name	Description
1 / 2	Dynamic Code (ACG)	Process attempted to generate or execute dynamic code.
3 / 4	Child Process Creation	Process attempted to create a disallowed child process.
5 / 6	Low Integrity Image Load	Process attempted to load a DLL marked with Low Integrity label.
7 / 8	Remote Image Load	Process attempted to load a DLL from a network share (UNC path).
9 / 10	Win32k System Calls	Process attempted to invoke Win32k system calls.
11 / 12	Code Integrity / Signing	Module failed Microsoft/Store signature or dependency signing check.
23 / 24	User Shadow Stack (CET)	Hardware-enforced stack protection detected return address corruption.
33 / 34	Font Restrictions	Process attempted to load a non-system (GDI) font.

Applied Mitigations per Application (Baseline: 73 Apps)

`7z.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Enforce Module Dependency Signing

`7za.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Enforce Module Dependency Signing

`7zFM.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Enforce Module Dependency Signing

`7zG.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Enforce Module Dependency Signing

`Acrobat.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`AcroRd32.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`AMDAutoUpdate.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`amdfendrsr.exe`

Strict Handle Checks: Disabled (Exemption)

`chrome.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Require ASLR on DLLs, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Disabled (Exemption)
System Calls: Allow Win32k
Child Process Restrictions: Allowed
Extension Point Disabling: Disabled
Dynamic Code Restrictions: Allowed

`Code.exe`

System Calls: Allow Win32k
Strict Handle Checks: Disabled (Exemption)

`Docker Desktop.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`dockerd.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`DPM.exe`

Font Disabling: Allow Non-System Fonts

`driverscloud.exe`

Font Disabling: Allow Non-System Fonts

`EXCEL.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF+, IAF, StackPivot, CallerCheck, SimExec

`ExtExport.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`firefox.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`fltldr.exe`

Data Execution Prevention (DEP): Enabled
Image Load Restrictions: Block Remote Images
Child Process Restrictions: Disallow Child Processes
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`GamingServices.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`GROOVE.EXE`

Data Execution Prevention (DEP): Enabled
Image Load Restrictions: Block Remote Images
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Child Process Restrictions: Disallow Child Processes

`HfcDisableService.exe`

Strict Handle Checks: Disabled (Exemption)

`ie4uinit.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`ieinstal.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`ielowutil.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`ieUnatt.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`iexplore.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Disabled (Exemption)
System Calls: Allow Win32k
Extension Point Disabling: Enabled
Dynamic Code Restrictions: Allowed
Control Flow Guard (CFG): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`INFOPATH.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`java.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`javaw.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`javaws.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`JOSM.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`LYNC.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`MEInfoWin64.exe`

Strict Handle Checks: Disabled (Exemption)
Control Flow Guard (CFG): Enabled
Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR):
SEHOP: Enabled

`mmc.exe`

Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`MSACCESS.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`mscorsvw.exe`

Extension Point Disabling: Disabled

`msedge.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Require ASLR on DLLs, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Disabled (Exemption)
System Calls: Allow Win32k
Extension Point Disabling: Disabled

`msfeedssync.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`mshta.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images

`MSPUB.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`ngen.exe`

Extension Point Disabling: Disabled

`ngentask.exe`

Extension Point Disabling: Disabled
Hardware-enforced Stack Protection (Shadow Stack): Disabled (Exemption)

`notepad++.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Allowed (Audit)
Signed Binary Restrictions: Enforce Module Dependency Signing
Child Process Restrictions: Allowed (Audit)
Font Disabling: Disable Non-System Fonts

`OIS.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`ONEDRIVE.EXE`

Data Execution Prevention (DEP): Enabled
Image Load Restrictions: Block Remote Images
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Child Process Restrictions: Allowed
Font Disabling: Allow Non-System Fonts
Dynamic Code Restrictions: Allowed

`OUTLOOK.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`plugin-container.exe`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`POWERPNT.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF+, IAF, StackPivot, CallerCheck, SimExec

`PPTVIEW.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF+, IAF, StackPivot, CallerCheck, SimExec

`PresentationHost.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
SEHOP: Enabled
Heap Protection: Terminate on corruption

`PrintDialog.exe`

Extension Point Disabling: Disabled

`qbittorrent.exe`

Strict Handle Checks: Disabled (Exemption)

`Regsvr32.exe`

Image Load Restrictions: Block Remote Images, Block Low-Label Images

`RstMwService.exe`

Strict Handle Checks: Disabled (Exemption)

`rundll32.exe`

Image Load Restrictions: Block Remote Images, Block Low-Label Images

`runtimebroker.exe`

Extension Point Disabling: Disabled

`scc.exe`

Address Space Layout Randomization (ASLR):
Strict Handle Checks: Disabled (Exemption)

`scc64.exe`

Address Space Layout Randomization (ASLR):
Strict Handle Checks: Disabled (Exemption)

`SeqZ.exe`

Strict Handle Checks: Disabled (Exemption)

`SetupHost.exe`

Strict Handle Checks: Disabled (Exemption)

`ssh-agent.exe`

Extension Point Disabling: Disabled
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions:

`SystemSettings.exe`

Extension Point Disabling: Disabled

`Teams.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Require ASLR on DLLs, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Disabled (Exemption)
Extension Point Disabling: Disabled
Child Process Restrictions: Allowed (Audit)
Dynamic Code Restrictions: Allowed (Audit)

`transmission-qt.exe`

Font Disabling: Allow Non-System Fonts

`VISIO.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`vlc.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Child Process Restrictions: Allowed (Audit)
Font Disabling: Disable Non-System Fonts

`vmtoolsd.exe`

Strict Handle Checks: Disabled (Exemption)

`VPREVIEW.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`WinRAR.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Enforce Module Dependency Signing
Child Process Restrictions: Allowed (Audit)

`WINWORD.EXE`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`wmplayer.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images Disabled (Exemption)
Payload Restrictions: StackPivot, CallerCheck, SimExec

`wordpad.exe`

Data Execution Prevention (DEP): Enabled
Payload Restrictions: EAF, EAF+, IAF, StackPivot, CallerCheck, SimExec

`Zoom.exe`

Data Execution Prevention (DEP): Enabled
Address Space Layout Randomization (ASLR): Force Relocate Images, Require ASLR on DLLs, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Enabled
Extension Point Disabling: Disabled
Child Process Restrictions: Allowed (Audit)
Dynamic Code Restrictions: Allowed (Audit)

Applied Mitigations: Optional Hardened Services (26 Services)

`AggregatorHost.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only

`audiodg.exe`

Strict Handle Checks: Enabled
Child Process Restrictions: Disallow Child Processes

`csrss.exe`

Font Disabling: Allow Non-System Fonts

`ctfmon.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only
Font Disabling: Disable Non-System Fonts
Child Process Restrictions: Disallow Child Processes

`dasHost.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only

`explorer.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Strict Handle Checks: Disabled (Exemption)
Font Disabling: Disable Non-System Fonts

`fontdrvhost.exe`

Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only
Font Disabling: Disable Non-System Fonts
Child Process Restrictions: Disallow Child Processes

`lsass.exe`

Extension Point Disabling: Disabled
Child Process Restrictions: Disallow Child Processes
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only

`SearchFilterHost.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Allowed
Child Process Restrictions: Disallow Child Processes

`SearchIndexer.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions: Microsoft Signed Only

`SearchProtocolHost.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Allowed
Signed Binary Restrictions: Microsoft Signed Only
Child Process Restrictions: Disallow Child Processes

`SecurityHealthService.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code

`SecurityHealthSystray.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code

`SgrmBroker.exe`

System Calls: Disable Win32k

`sihost.exe`

Strict Handle Checks: Enabled
Signed Binary Restrictions: Microsoft Signed Only

`smartscreen.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Allowed
Signed Binary Restrictions: Microsoft Signed Only

`spoolsv.exe`

Dynamic Code Restrictions: Allowed
Strict Handle Checks: Enabled
Signed Binary Restrictions:
Child Process Restrictions: Allowed (Audit)

`svchost.exe`

Address Space Layout Randomization (ASLR): Force Relocate Images, Bottom-Up ASLR, High Entropy ASLR
Control Flow Guard (CFG): Enabled
Font Disabling: Disable Non-System Fonts
Extension Point Disabling: Disabled
Signed Binary Restrictions:
Dynamic Code Restrictions: Allowed

`taskhostw.exe`

Signed Binary Restrictions:

`userinit.exe`

Font Disabling: Allow Non-System Fonts

`vmcompute.exe`

Control Flow Guard (CFG): Enabled

`vmwp.exe`

Control Flow Guard (CFG): Enabled

`wininit.exe`

Dynamic Code Restrictions: Block Dynamic Code

`winlogon.exe`

Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions:
Font Disabling: Allow Non-System Fonts

`wlanext.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code
Signed Binary Restrictions:

`WUDFHost.exe`

Strict Handle Checks: Enabled
Dynamic Code Restrictions: Block Dynamic Code

Name		Name	Last commit message	Last commit date
EP-HardenedServices.xml		EP-HardenedServices.xml
EP-Reset.xml		EP-Reset.xml
EP-W10-Audit.xml		EP-W10-Audit.xml
EP-W10.xml		EP-W10.xml
EP-W11-Audit.xml		EP-W11-Audit.xml
EP-W11.xml		EP-W11.xml
Get-ExploitProtectionEvents.ps1		Get-ExploitProtectionEvents.ps1
Install-ExploitProtectionPolicy.ps1		Install-ExploitProtectionPolicy.ps1
README.md		README.md
Uninstall-ExploitProtectionPolicy.ps1		Uninstall-ExploitProtectionPolicy.ps1

Latest commit

History

Folders and files

Repository files navigation

Exploit Protection Policy for Windows 10 & 11

Architecture & Profiles

System-Wide Mitigations

Deterministic State & Legacy Mitigation Sanitization

Modern Attack Surface Reduction (ASR) for Office & Adobe

Enabling ASR Rules via PowerShell

Lifecycle: Evaluation, Deployment & Rollback

Step 1: Pre-Deployment Evaluation (Audit Mode)

Step 2: Telemetry & Event Log Monitoring

Step 3: Production Enforcement

Step 4: Complete Rollback & Uninstallation

Event Log Reference

Applied Mitigations per Application (Baseline: 73 Apps)

7z.exe

7za.exe

7zFM.exe

7zG.exe

Acrobat.exe

AcroRd32.exe

AMDAutoUpdate.exe

amdfendrsr.exe

chrome.exe

Code.exe

Docker Desktop.exe

dockerd.exe

DPM.exe

driverscloud.exe

EXCEL.EXE

ExtExport.exe

firefox.exe

fltldr.exe

GamingServices.exe

GROOVE.EXE

HfcDisableService.exe

ie4uinit.exe

ieinstal.exe

ielowutil.exe

ieUnatt.exe

iexplore.exe

INFOPATH.EXE

java.exe

javaw.exe

javaws.exe

JOSM.exe

LYNC.EXE

MEInfoWin64.exe

mmc.exe

MSACCESS.EXE

mscorsvw.exe

msedge.exe

msfeedssync.exe

mshta.exe

MSPUB.EXE

ngen.exe

ngentask.exe

notepad++.exe

OIS.EXE

ONEDRIVE.EXE

OUTLOOK.EXE

plugin-container.exe

POWERPNT.EXE

PPTVIEW.EXE

PresentationHost.exe

PrintDialog.exe

qbittorrent.exe

Regsvr32.exe

RstMwService.exe

rundll32.exe

runtimebroker.exe

scc.exe

scc64.exe

SeqZ.exe

SetupHost.exe

ssh-agent.exe

SystemSettings.exe

Teams.exe