exploit-protection-policy

Wed, 22 May 2024 00:00:00 +0000

Exploit-Protection-policy provides a production-hardened Exploit Protection (EP) policy tailored for Windows 10 and Windows 11 systems. It combines multiple industry-standard security baselines with advanced restrictions to maximize security without breaking compatibility with everyday applications.

This policy has been tested in air-gapped systems to protect endpoints from advanced threat vectors while maintaining productivity.

Merged Security Baselines

DISA STIG Exploit Protection v3.
Microsoft Security Baseline Exploit Protection policy (specifically aligned for enterprise systems).
milgradesec’s custom Exploit Protection rule configurations.

Key Protections Enforced

System-Wide Mitigations: Enforces fundamental protections such as Control Flow Guard (CFG), Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Heap Protection by default.
Advanced Payload Controls: Restricts execution vectors using Export Address Filtering (EAF/EAF+), Import Address Filtering (IAF), and Return-Oriented Programming (ROP) mitigations.
Image & Code Integrity Restrictions: Blocks loading of low-integrity or remote images, preventing malicious library injection.
Application-Specific Tuning: Includes pre-configured exceptions and application rules to balance high-security containment with software compatibility.

Security-ADMX

Sun, 19 May 2024 00:00:00 +0000

Security-ADMX is a collection of custom Administrative Templates (.admx and .adml) specifically designed for hardening Windows 10 and Windows 11 workstations. It allows system administrators and security engineers to configure advanced security settings via local or domain Group Policy (GPO) that are otherwise difficult or tedious to manage.

Developed out of the need to streamline security compliance across embedded and workstation deployments, this project packages several security controls into easily manageable policies.

Windows Hardening | Florian Stosse

exploit-protection-policy

Merged Security Baselines

Key Protections Enforced

Security-ADMX