Serious Discussion Any replacements for Microsoft Defender Exploit Protection?

[Victor M]

Hi Everyone,

I recently deployed Windows Defender Exploit Protection for all my applications that are allowed through the firewall. This is in accordance with PCI DSS 2.5.5b. It is mediocre protection I know, but it stopped my red team for half an hour. Are there any commercial programs that do this kind of thing? I know there is MalwareBytes Anti-Exploit, but it only protects a few apps chosen by them. Are there any others who implement Windows Dedender Exploit Protection's methods but in a more reliable way? The apps that I allow through the firewall are few, and they are these: WWAHost, AuthHost, smartscreen, deviceCensus, MSEdge, svchost, NcsiUwpApp, Recommended Troubleshooting Client and SecHealthUI. All of them are Windows native exe's. My red team is obviously targeting one or two of those apps or else they wouldn't have been stuck.

By the way, OpenEDR is great and has good and useful alerts. And I like their Comodo AV's App Container. My red team has yet to penetrate that.

 

[SpyNetGirl]

Hi,
I use exploit protections in the Microsoft Defender category here:

GitHub - HotCakeX/Harden-Windows-Security: Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Ente

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers...

github.com

I apply them to system components and some 1st/3rd party programs.

This is only one layer of security and doesn't have to stop any attacks on its own, it's just one piece of the puzzle. If you want to give your red team a realistic challenge I suggest using the Harden Windows security module, apply all of the categories, and then let them penetration test your system, with Standard user privileges of course.

Here is document about pentesting using my module:

Harden-Windows-Security/Rationale.md at main · HotCakeX/Harden-Windows-Security

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers...

github.com

Let me know if you have any feedback/questions!

 

[Victor M]

Hi @SpyNetGirl ,

We meet again. My other layers of protection currently on that box is some hardened/disabled services, SRP, and some group policy items. The main defenses are Comodo's Internet Security which is packaged and free from OpenEDR, and Cyber Lock. This configuration is deployed because I want to test out the recommended configuration of OpenEDR. The Cyber Lock piece is a protection that I always deploy so I left it on.

I tried to deploy MS Security Baseline also but it conflicts with Comodo - system won't boot. I think it is due to one group policy item which disallows turning off Windows Defender. I will try again tomorrow and disable that item and see if that works.

Does it take a long time to understand how to use your hardening?

 

[SpyNetGirl]

Hi @SpyNetGirl ,

We meet again. My other layers of protection currently on that box is some hardened/disabled services and some group policy items. The main defenses are Comodo's Internet Security which is packaged and free from OpenEDR, and Cyber Lock. This configuration is deployed because I want to test out the recommended configuration of OpenEDR. The Cyber Lock piece is a protection that I always deploy so I left it on.

I tried to deploy MS Security Baseline also but it conflicts with Comodo - system won't boot. I think it is due to one group policy item which disallows turning off Windows Defender. I will try again tomorrow and disable that item and see if that works.

Does it take a long time to understand how to use your hardening?

Hi,
no it doesn't take long at all, the GitHub readme explains every single hardening measure it applies with links to official documents for further reading.
the time it takes to apply them is just few seconds. I can assure you that if you use it you will be far more secure than using Comodo or Cyber lock.

The hardening measures the module uses are industry standards and constantly proven to stop kill chains in the attacks. Many of the threat actors reports published by Microsoft security intelligence suggest using these measures. It is Totally worth the time to go through the hardening measures and get familiar with them.

But they are not compatible with 3rd party security solutions. They need to be in full control. You can do a cost assessment and see how it will benefit you to use the policies for free and if you need EDR/SIEM capabilities then use Defender for Endpoint or Sentinel.

The good thing is that it's plain-text PowerShell code so you can integrate and automate it easily with other tools such as Intune, SCCM etc. I recently added CSPs for all of the hardening measures in the Readme.

 

[Victor M]

I now see that with MalwareBytes Anti-Exploit you can add programs to their list. I added all the apps in my firewall, but MBAE only acknowledges a few of them. So I wonder if it can protect them all.

 

[Kongo]

HitmanPro.Alert would be another option you have apart from Windows built in one. I am not sure if its regularly updated tho.

 

[Victor M]

I forgot to mention that I am not using Comodo's firewall. It has a few rules that I couldn't figure out what the allowed exe's are - it's just a generic name. So I fall back on Windows's own firewall, outbound set to disallow, with MalwareBytes Windows Firewall Control.

 

[partha_roy]

A proper antivirus will also protect from exploits; you can additionally make some changes through the group policy editor to disable the execution of scripts as a prevention measure

 

[Sandbox Breaker]

Kaspersky is amazing at exploits. If you run Harmony then you get checkpoint and Kaspersky anti exploit which is amazing. Add threat emulation to that and GG

 

[Shadowra]

Hitman Pro Alert / CyberLock

 

[Andy Ful]

It is not possible to stop the RedTeams, except when making the computer unusable.
Your RedTeam most probably exploits abuses Svchost by injecting the DLL or shellcode.

You can try to identify what is exploited by using the combination of Hard_Configurator (set to block also Administrators + block all LOLBins) and strict WDAC policy (only Windows and Microsoft binaries allowed, dynamic code trust, no ISG). Do not forget to make a System Restore Point. This setup should be applied before the RedTeam attack. Next, you must inspect the H_C security log and WDAC events.
Your RedTem probably knows your Admin credentials, Microsoft Account passwords (and others too), so it will be hard to prevent their actions.

Edit.
I am not sure if you are on the right way. You should not focus on stopping your RedTeam but rather on using the setup that can demotivate other RedTeams and hackers.

 

[B-boy/StyLe/]

Btw only for the protocol Appcheck also have Anti-Exploit, but I didn't use it for a while, so I am not sure if you can add custom programs in the newer version. In the older ones, there wasn't such an option.

[Notice] AppCheck 2.4.10.1 Update : Exploit Guard Official Release - Notice - CheckMAL

Various information is provided including new products, AppCheck update details, and event information.

www.checkmal.com

Now Win 10/11 have built-in anti-exploit but in the past one should have used EMET. But it is end of life now since 2018.
Back in the time 2011-2012, there was an application called Crystal Anti-Exploit Protection as well. But this is only for the protocol as well.

 

[oldschool]

HitmanPro.Alert would be another option you have apart from Windows built in one. I am not sure if its regularly updated tho.

I believe it's more like the walking dead!

 

[[correlate]]

Hi,
I use exploit protections in the Microsoft Defender category here:

GitHub - HotCakeX/Harden-Windows-Security: Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Ente

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers...

github.com

I apply them to system components and some 1st/3rd party programs.

This is only one layer of security and doesn't have to stop any attacks on its own, it's just one piece of the puzzle. If you want to give your red team a realistic challenge I suggest using the Harden Windows security module, apply all of the categories, and then let them penetration test your system, with Standard user privileges of course.

Here is document about pentesting using my module:

Harden-Windows-Security/Rationale.md at main · HotCakeX/Harden-Windows-Security

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Pers...

github.com

Let me know if you have any feedback/questions!

Harden's solution is safe and effective
I'm grateful to find people like you

 

[SpyNetGirl]

Harden's solution is safe and effective
I'm grateful to find people like you

Thank you for the kind words!

 

[Victor M]

Hi

I have good and bad news to report. The good news is that MalwareBytes Anti-Exploit does add to the security of all apps mentioned in the firewall rules - it took my red team 3-4 hours to get past that. The bad news is that they did get thru. So I will keep MBAE in my defense arsenal. Mind you, that is 2 anti-exploit layers - MS Defender Exploit Protection and MBAE.

 

[Victor M]

Kaspersky is amazing at exploits. If you run Harmony then you get checkpoint and Kaspersky anti exploit which is amazing.

Have you verified/tested that Kaspersky does handle and stop exploits?

 

[Xeno1234]

Have you verified/tested that Kaspersky does handle and stop exploits?

To be fair - it’s Kaspersky. It excells in anything related to malware.

 

[SumTingWong]

HitmanPro.Alert would be another option you have apart from Windows built in one. I am not sure if its regularly updated tho.

Last update is 09/2022.

 

[Victor M]

Hi @Kongo ,

As I remember it, HitmanPro Alert does not have any options to add other programs to be protected, it only protects the few things it has built in, mainly browsers. But I may be wrong.