Resolver problemas de mitigações de exploit protection

  • Artigo

Aplica-se a:

Quer experimentar o Defender para Ponto Final? Inscrever-se para uma avaliação gratuita.

Quando cria um conjunto de mitigações de proteção contra exploits (conhecido como configuração), poderá constatar que o processo de exportação e importação de configuração não remove todas as mitigações indesejadas.

Pode remover manualmente mitigações indesejadas no Segurança do Windows ou pode utilizar o seguinte processo para remover todas as mitigações e, em seguida, importar um ficheiro de configuração de linha de base.

  1. Remova todas as mitigações de processos com este script do PowerShell:

    # Check if Admin-Privileges are available
function Test-IsAdmin {
    ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
}

# Delete ExploitGuard ProcessMitigations for a given key in the registry. If no other settings exist under the specified key,
# the key is deleted as well
function Remove-ProcessMitigations([Object] $Key, [string] $Name) {
    Try {
        if ($Key.GetValue("MitigationOptions")) {
            Write-Host "Removing MitigationOptions for:      " $Name
            Remove-ItemProperty -Path $Key.PSPath -Name "MitigationOptions" -ErrorAction Stop;
        }
        if ($Key.GetValue("MitigationAuditOptions")) {
            Write-Host "Removing MitigationAuditOptions for: " $Name
            Remove-ItemProperty -Path $Key.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop;
        }
        if ($Key.GetValue("EAFModules")) {
            Write-Host "Removing EAFModules for: " $Name
            Remove-ItemProperty -Path $Key.PSPath -Name "EAFModules" -ErrorAction Stop;
        }

        # Remove the FilterFullPath value if there is nothing else
        if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 1) -and ($Key.GetValue("FilterFullPath"))) {
            Remove-ItemProperty -Path $Key.PSPath -Name "FilterFullPath" -ErrorAction Stop;
        }

        # If the key is empty now, delete it
        if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 0)) {
            Write-Host "Removing empty Entry:                " $Name
            Remove-Item -Path $Key.PSPath -ErrorAction Stop
        }
    }
    Catch {
        Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)"
    }
}

# Delete all ExploitGuard ProcessMitigations
function Remove-All-ProcessMitigations {
    if (!(Test-IsAdmin)) {
        throw "ERROR: No Administrator-Privileges detected!"; return
    }

    Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | ForEach-Object {
        $MitigationItem = $_;
        $MitigationItemName = $MitigationItem.PSChildName

        Try {
            Remove-ProcessMitigations $MitigationItem $MitigationItemName

            # "UseFilter" indicate full path filters may be present
            if ($MitigationItem.GetValue("UseFilter")) {
                Get-ChildItem -Path $MitigationItem.PSPath | ForEach-Object {
                    $FullPathItem = $_
                    if ($FullPathItem.GetValue("FilterFullPath")) {
                        $Name = $MitigationItemName + "-" + $FullPathItem.GetValue("FilterFullPath")
                        Write-Host "Removing FullPathEntry:              " $Name
                        Remove-ProcessMitigations $FullPathItem $Name
                    }

                    # If there are no subkeys now, we can delete the "UseFilter" value
                    if ($MitigationItem.SubKeyCount -eq 0) {
                        Remove-ItemProperty -Path $MitigationItem.PSPath -Name "UseFilter" -ErrorAction Stop
                    }
                }
            }
            if (($MitigationItem.SubKeyCount -eq 0) -and ($MitigationItem.ValueCount -eq 0)) {
                Write-Host "Removing empty Entry:                " $MitigationItemName
                Remove-Item -Path $MitigationItem.PSPath -ErrorAction Stop
            }
        }
        Catch {
            Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)"
        }
    }
}

# Delete all ExploitGuard System-wide Mitigations
function Remove-All-SystemMitigations {

    if (!(Test-IsAdmin)) {
        throw "ERROR: No Administrator-Privileges detected!"; return
    }

    $Kernel = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel"

    Try {
        if ($Kernel.GetValue("MitigationOptions"))
            { Write-Host "Removing System MitigationOptions"
                Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationOptions" -ErrorAction Stop;
            }
        if ($Kernel.GetValue("MitigationAuditOptions"))
            { Write-Host "Removing System MitigationAuditOptions"
                Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop;
            }
    } Catch {
        Write-Host "ERROR:" $_.Exception.Message "- System"
    }
}

Remove-All-ProcessMitigations
Remove-All-SystemMitigations

  2. Create e importar um ficheiro de configuração XML com as seguintes mitigações predefinidas, conforme descrito em Importar, exportar e implementar configurações do Exploit Protection:

     <?xml version="1.0" encoding="UTF-8"?>
 <root>
    <SystemConfig/>
    <AppConfig Executable="ExtExport.exe">
       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
    <AppConfig Executable="ie4uinit.exe">
      <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
    <AppConfig Executable="ieinstal.exe">
   <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
    <AppConfig Executable="ielowutil.exe">
      <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
   <AppConfig Executable="ieUnatt.exe">
      <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
   <AppConfig Executable="iexplore.exe">
      <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
   <AppConfig Executable="mscorsvw.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
    <AppConfig Executable="msfeedssync.exe">
       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
    <AppConfig Executable="mshta.exe">
       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true"/>
    </AppConfig>
    <AppConfig Executable="ngen.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
    <AppConfig Executable="ngentask.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
    <AppConfig Executable="PresentationHost.exe">
       <DEP Enable="true" OverrideDEP="false" EmulateAtlThunks="false"/>
       <ASLR OverrideForceRelocateImages="false" ForceRelocateImages="false" Enable="true" OverrideBottomUp="false" HighEntropy="true" BottomUp="true"/>
       <SEHOP Enable="true" OverrideSEHOP="false" TelemetryOnly="false"/>
       <Heap OverrideHeap="false" TerminateOnError="true"/>
    </AppConfig>
    <AppConfig Executable="PrintDialog.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
    <AppConfig Executable="PrintIsolationHost.exe"/>
    <AppConfig Executable="runtimebroker.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
        <AppConfig Executable="splwow64.exe"/>
    <AppConfig Executable="spoolsv.exe"/>
    <AppConfig Executable="svchost.exe"/>
    <AppConfig Executable="SystemSettings.exe">
       <ExtensionPoints OverrideExtensionPoint="false" DisableExtensionPoints="true"/>
    </AppConfig>
</root>

Se ainda não o fez, recomendamos que transfira e utilize a Segurança do Windows Linhas de Base para concluir a personalização da Proteção contra exploits.

Sugestão

Quer saber mais? Engage com a comunidade de Segurança da Microsoft na nossa Comunidade Tecnológica: Microsoft Defender para Endpoint Tech Community.