A Windows security capability that enforces exploit mitigations both system-wide and for individual applications. It took the place of EMET, whose support ended in 2018.
Also called EMET.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Exploit protection in context, with comparison tables and the common traps.
Terms in this definition
- Capability
Something that a person, organisation or system is able to do.
Related terms
- Audit mode
Lets exploit protection or App Control for Business policies be trialled before enforcement: blocked actions are allowed but logged.
- DEP
Enabled by default; prevents code executing from memory marked as data. One of the exploit protection mitigations.
- DeviceEvents
Holds a mix of event types from endpoints in advanced hunting, among them alerts from protection features like exploit protection and Microsoft Defender Antivirus.
- EAF
Protects the export address table in important system modules as one of the exploit protection mitigations. It has been deprecated, together with IAF (import address filtering), because it causes app compatibility problems.
- IAF
An exploit protection mitigation that watches for changes to an app's import address table. Like EAF, it has been deprecated because it caused problems with app compatibility.