Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1038483">That is why I like Code Integrity Guard (CIG) of Windows Defender Exploit Protection. I don&#039;t have the link to the article anymore, but when EMET came out, there was a thread on an sysadmin website where admins added EMET to medium level integrity Windows (7) processes and shared information. I reckoned I could do the same for CIG for all windows processes running medium level integrity rights (taskhost, svchost, explorer, etc) and my Windows10 Pro runs and updates without problems.When you use a third-party AV most AV&#039;s inject their DLL&#039;s into programs (for behavioral monitoring) so using CIG is impossible. When I run Kaspersky Free <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />or Bitdefender Free <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />I don&#039;t have this problem (CIG can be used as extra protection). With MBAM consumer version I can disable MBAE for Office and Edge, so it is also possible to use CIG for Microsoft programs and services. Deselecting MBAE protection also stops injecting the MBAE-DLL in those processes <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /> which makes it possible to add another layer of protection.This test confirmed (thanks [USER=63803]@RoxasDev[/USER]) confirmed that adding those extra settings to harden important system and easily attacked (medium IL) processes is well worth the effort.&nbsp; When I can&#039;&#039;t use CIG (e.g. on my wife&#039;s laptop running Avast Free) I always enable &quot;disable extension points&quot; for critical Windows processes (and all Microsoft application programs).[ATTACH=full]275086[/ATTACH]Note: Disabling the option to inject a DLL into all programs using AppInit is also possible with GPO.</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1038483"] That is why I like Code Integrity Guard (CIG) of Windows Defender Exploit Protection. I don't have the link to the article anymore, but when EMET came out, there was a thread on an sysadmin website where admins added EMET to medium level integrity Windows (7) processes and shared information. I reckoned I could do the same for CIG for all windows processes running medium level integrity rights (taskhost, svchost, explorer, etc) and my Windows10 Pro runs and updates without problems. When you use a third-party AV most AV's inject their DLL's into programs (for behavioral monitoring) so using CIG is impossible. When I run Kaspersky Free (y)or Bitdefender Free (y)I don't have this problem (CIG can be used as extra protection). With MBAM consumer version I can disable MBAE for Office and Edge, so it is also possible to use CIG for Microsoft programs and services. Deselecting MBAE protection also stops injecting the MBAE-DLL in those processes (y) which makes it possible to add another layer of protection. This test confirmed (thanks [USER=63803]@RoxasDev[/USER]) confirmed that adding those extra settings to harden important system and easily attacked (medium IL) processes is well worth the effort. When I can''t use CIG (e.g. on my wife's laptop running Avast Free) I always enable "disable extension points" for critical Windows processes (and all Microsoft application programs). [ATTACH type="full" alt="1683182319729.png"]275086[/ATTACH] Note: Disabling the option to inject a DLL into all programs using AppInit is also possible with GPO. [/QUOTE]

Verification