Microsoft Defender for Endpoint
Endpoint protectionEvaluate exploit protection
In brief
The article adds clearer audit-mode guidance, default mitigation tables, deprecated program-setting details, compatibility notes, configuration instructions, and updated PowerShell examples.
What Defender admins need to know
Administrators have more guidance for testing mitigations, reviewing audit results, and configuring protection before production enforcement.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Evaluate exploit protection
This article explains how to use audit mode to evaluate exploit protection mitigations, review compatibility guidelines, configure system and program settings for testing, and interpret audit events before you enable mitigations in production.
Exploit protection helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.)
In audit, you can see how mitigation works for certain apps in a test environment. ThisAudit mode shows what would happen if you enable exploit protection in your production environment. This way,By using audit mode, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
GenericGeneral guidelines for evaluating exploit protection
Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection.
What kinds of software shouldn't be protected by exploit protection?
- Anti-malware and intrusion prevention or detection software
- Debuggers
- Software that handles digital rights management (DRM) technologies (that is, video games)
- Software that use anti-debugging, obfuscation, or hooking technologies
What type of applications should you consider enabling exploit protection?
Applications that receive or handle untrusted data.
What type of processes are out of scope for exploit protection?
Services
Exploit protection mitigations enabled by default
The following table lists the exploit protection mitigations that are enabled by default:
| Mitigation | Enabled by default |
|---|---|
| Data Execution Prevention (DEP) | 64-bit and 32-bit applications |
Deprecated "Program settings" mitigations
The following program settings mitigations are deprecated. The table explains why each one was removed:
| "Program settings" mitigations | Reason |
|---|---|
| Export address filtering (EAF) | Application compatibility issues |
The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues can be introduced when you apply certain add-ins or other components to the standard software.
The xml sample is available below
<?xml version="1.0" encoding="UTF-8"?>
<MitigationPolicy>
<SystemConfig>
### Windows Security app
1. Open the Windows Security app. Select the shield icon in the task bar or search the start menu for **Windows Security**.
1. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**.
To set app-level mitigations to test mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet.
Configure each mitigation in the following format:
```PowerShell
Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>
|Disable Win32k system calls|`AuditSystemCall`|
|Don't allow child processes|`AuditChildProcess`|
For example, to enable Arbitrary Code Guard (ACG) in test mode for an app named *testing.exe*, run the following command:
```PowerShell
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|9|Disable win32k system calls audit|
|Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|11|Code integrity guard audit|
## See also
- [Enable exploit protection](enable-exploit-protection.md)
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
| Product | Exploit protection mitigation |
|---|---|
| .NET 2.0/3.5 | EAF/IAF |
| High-entropy ASRL | Use default (On) |
| Validate exception chains (SEHOP) | Use default (On) |
The following XML sample shows the default system mitigation configuration:
<?xml version="1.0" encoding="UTF-8"?>
<MitigationPolicy>
<SystemConfig>
### Windows Security app
Use the Windows Security app to configure exploit protection mitigations in test mode for a specific program:
1. Open the Windows Security app. Select the shield icon in the task bar or search the start menu for **Windows Security**.
1. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**.
To set app-level mitigations to test mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet.
Use the following `Set-ProcessMitigation` syntax to enable or audit mitigations for a specific app. Replace the placeholders with the scope, executable, action, and mitigation cmdlets:
```PowerShell
Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>
|Disable Win32k system calls|`AuditSystemCall`|
|Don't allow child processes|`AuditChildProcess`|
For example, the following command enables Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, so you can test the impact of dynamic code restrictions before enforcing them:
```PowerShell
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|9|Disable win32k system calls audit|
|Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|11|Code integrity guard audit|
<a name="see-also"></a>
## Related content
- [Enable exploit protection](enable-exploit-protection.md)
- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
@@ -12,37 +12,43 @@ ms.collection: - m365-security - tier2 - mde-asr-ms.date: 06/17/2026+ms.date: 07/03/2026 appliesto: - Microsoft Defender for Endpoint Plan 1 - Microsoft Defender for Endpoint Plan 2 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Evaluate exploit protection +This article explains how to use audit mode to evaluate exploit protection mitigations, review compatibility guidelines, configure system and program settings for testing, and interpret audit events before you enable mitigations in production.+ [Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.) -In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* happen if you enable exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.+In audit, you can see how mitigation works for certain apps in a test environment. Audit mode shows what *would* happen if you enable exploit protection in your production environment. By using audit mode, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur. -## Generic guidelines+<a name="generic-guidelines"></a>+## General guidelines for evaluating exploit protection Exploit protection mitigations work at a low level in the operating system, and some kinds of software that perform similar low-level operations might have compatibility issues when they're configured to be protected by using exploit protection. -#### What kinds of software shouldn't be protected by exploit protection?+<a name="what-kinds-of-software-shouldnt-be-protected-by-exploit-protection"></a>+### What kinds of software shouldn't be protected by exploit protection? - Anti-malware and intrusion prevention or detection software - Debuggers - Software that handles digital rights management (DRM) technologies (that is, video games) - Software that use anti-debugging, obfuscation, or hooking technologies -#### What type of applications should you consider enabling exploit protection?+<a name="what-type-of-applications-should-you-consider-enabling-exploit-protection"></a>+### What type of applications should you consider enabling exploit protection? Applications that receive or handle untrusted data. -#### What type of processes are out of scope for exploit protection?+<a name="what-type-of-processes-are-out-of-scope-for-exploit-protection"></a>+### What type of processes are out of scope for exploit protection? Services @@ -51,6 +57,8 @@ Services ## Exploit protection mitigations enabled by default +The following table lists the exploit protection mitigations that are enabled by default:+ | Mitigation | Enabled by default | | -------- | -------- | | Data Execution Prevention (DEP) | 64-bit and 32-bit applications |@@ -59,6 +67,8 @@ Services ## Deprecated "Program settings" mitigations +The following program settings mitigations are deprecated. The table explains why each one was removed:+ | "Program settings" mitigations | Reason | | -------- | -------- | | Export address filtering (EAF) | Application compatibility issues |@@ -89,6 +99,9 @@ Google Chrome no longer recommends enabling Exploit Protection (EMET) because it The following table lists specific products that have compatibility issues with the mitigations that are included in exploit protection. You must disable specific incompatible mitigations if you want to protect the product by using exploit protection. Be aware that this list takes into consideration the default settings for the latest versions of the product. Compatibility issues can be introduced when you apply certain add-ins or other components to the standard software. +> [!NOTE]+> EMET mitigations might be incompatible with Oracle Java when they're run by using settings that reserve a large chunk of memory for the virtual machine (that is, by using the -Xms option).+ | Product | Exploit protection mitigation | | -------- | -------- | | .NET 2.0/3.5 | EAF/IAF |@@ -125,9 +138,9 @@ These Exploit Protection system settings are enabled by default except for the M | High-entropy ASRL | Use default (On) | | Validate exception chains (SEHOP) | Use default (On) | -The xml sample is available below+The following XML sample shows the default system mitigation configuration: -```+```xml <?xml version="1.0" encoding="UTF-8"?> <MitigationPolicy> <SystemConfig>@@ -149,6 +162,8 @@ You can set mitigations in a testing mode for specific programs by using the Win ### Windows Security app +Use the Windows Security app to configure exploit protection mitigations in test mode for a specific program:+ 1. Open the Windows Security app. Select the shield icon in the task bar or search the start menu for **Windows Security**. 1. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**.@@ -170,7 +185,7 @@ You can set mitigations in a testing mode for specific programs by using the Win To set app-level mitigations to test mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet. -Configure each mitigation in the following format:+Use the following `Set-ProcessMitigation` syntax to enable or audit mitigations for a specific app. Replace the placeholders with the scope, executable, action, and mitigation cmdlets: ```PowerShell Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>@@ -195,7 +210,7 @@ Where: |Disable Win32k system calls|`AuditSystemCall`| |Don't allow child processes|`AuditChildProcess`| -For example, to enable Arbitrary Code Guard (ACG) in test mode for an app named *testing.exe*, run the following command:+For example, the following command enables Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, so you can test the impact of dynamic code restrictions before enforcing them: ```PowerShell Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode@@ -216,7 +231,8 @@ To review which apps would be blocked, open Event Viewer and filter for the foll |Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|9|Disable win32k system calls audit| |Exploit protection|Security-Mitigations (Kernel Mode/User Mode)|11|Code integrity guard audit| -## See also+<a name="see-also"></a>+## Related content - [Enable exploit protection](enable-exploit-protection.md) - [Configure and audit exploit protection mitigations](customize-exploit-protection.md)