diff --git a/cheatsheets/C-Based_Toolchain_Hardening_Cheat_Sheet.md b/cheatsheets/C-Based_Toolchain_Hardening_Cheat_Sheet.md index bed548e352..78c3e3a38d 100644 --- a/cheatsheets/C-Based_Toolchain_Hardening_Cheat_Sheet.md +++ b/cheatsheets/C-Based_Toolchain_Hardening_Cheat_Sheet.md @@ -648,6 +648,10 @@ Visual Studio offers a number of debugging aids for use during development. The ![Windows1](../assets/C-Based_Toolchain_Hardening_Windows1.png) -Finally, for runtime hardening, Microsoft has a helpful tool called EMET. EMET is the [Enhanced Mitigation Experience Toolkit](https://en.wikipedia.org/wiki/Enhanced_Mitigation_Experience_Toolkit), and allows you to apply runtime hardening to an executable which was built without it. It's very useful for utilities and other programs that were built without an SDLC. +Finally, for runtime hardening, Microsoft provides **Windows Defender Exploit Guard** and the **Process Mitigation Management Tool**. +[Windows Defender Exploit Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection) replaces EMET and offers advanced exploit protection features. -![Windows2](../assets/C-Based_Toolchain_Hardening_Windows2.png) +Additionally, the [Process Mitigation Management Tool](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection) (`ProcessMitigations` module) allows administrators to configure exploit mitigation policies via PowerShell and Group Policy. + +![Windows2](exploit-protection-guard.png) + \ No newline at end of file diff --git a/exploit-protection-guard.png b/exploit-protection-guard.png new file mode 100644 index 0000000000..24a8282958 Binary files /dev/null and b/exploit-protection-guard.png differ