Microsoft Defender for Endpoint

Exploit Protection Reference

3 September 2026Doc update+1 / −1 lines

In brief

The documentation corrects “memory manger” to “memory manager” and adjusts spacing before an ellipsis in the mitigation description.

What Defender admins need to know

Administrators get a more accurate description of how unsigned binaries are blocked and the associated error.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Code integrity guard ensures that all binaries loaded into a process are digitally signed by Microsoft. Code integrity guard includes WHQL (Windows Hardware Quality Labs) signatures, which allows WHQL-approved drivers to run within the process.

This mitigation is implemented within the memory manager, which blocks the binary from being mapped into memory. If you attempt to load a binary that isn't signed by Microsoft, the memory ~~manger~~manager returns the error STATUS_INVALID_IMAGE_HASH. By blocking at the memory manager level, this prevents both binaries loaded by the process and binaries injected into the process.

Compatibility considerations

@@ -261,7 +261,7 @@ The most common use of fonts outside of the system fonts directory is with [web  Code integrity guard ensures that all binaries loaded into a process are digitally signed by Microsoft. Code integrity guard includes [WHQL](/windows-hardware/drivers/install/whql-release-signature) (Windows Hardware Quality Labs) signatures, which allows WHQL-approved drivers to run within the process. -This mitigation is implemented within the memory manager, which blocks the binary from being mapped into memory. If you attempt to load a binary that isn't signed by Microsoft, the memory manger returns the error STATUS_INVALID_IMAGE_HASH. By blocking at the memory manager level, this prevents both binaries loaded by the process and binaries injected into the process.+This mitigation is implemented within the memory manager, which blocks the binary from being mapped into memory. If you attempt to load a binary that isn't signed by Microsoft, the memory manager returns the error STATUS_INVALID_IMAGE_HASH. By blocking at the memory manager level, this prevents both binaries loaded by the process and binaries injected into the process.  ### Compatibility considerations