| name | implementing-memory-protection-with-dep-aslr |
| description | Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
|
| domain | cybersecurity |
| subdomain | endpoint-security |
| tags | ["endpoint","memory-protection","DEP","ASLR","exploit-mitigation","CFG"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"] |
Implementing Memory Protection with DEP and ASLR
When to Use
Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.
Common Misconfigurations & Verification
- DEP left at OptIn: the default
nx OptIn only protects Windows components, leaving most apps unprotected. Confirm bcdedit /enum {current} shows nx AlwaysOn (or OptOut with a justified, documented exclusion list) — not OptIn.
- Per-process ASLR opt-out: an app shipping its own
.exe.config or a registry MitigationOptions value under Image File Execution Options can disable ForceRelocateImages/BottomUp just for itself, silently reopening fixed-address ROP. Run Get-ProcessMitigation -Name <app>.exe and verify ASLR.ForceRelocateImages and BottomUp are ON, not NOTSET/OFF.
- Mandatory ASLR needs both flags: system-wide mandatory ASLR is only effective with BottomUp randomization enabled too; ForceRelocateImages alone leaves predictable layouts.
- CFG assumed universal: CFG only applies to binaries compiled with
/guard:cf. Get-ProcessMitigation -Name <app>.exe may show CFG ON while the loaded module has no CFG metadata — it cannot be retrofitted, so legacy DLLs remain exploitable.
- Verification:
Get-ProcessMitigation -System should report DEP, BottomUpASLR, HighEntropyASLR, SEHOP as ON; spot-check each hardened app with Get-ProcessMitigation -Name <app>.exe to confirm the deployed XML actually applied and wasn't overridden locally.
Prerequisites
- Windows 10/11 or Windows Server 2016+ with administrative privileges
- Group Policy management access for enterprise-wide deployment
- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)
- Test environment for validating application compatibility with exploit mitigations
Workflow
Step 1: Configure System-Level Mitigations
# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn
# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON
# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy
