Exploit Protection
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T0817 | Drive-by Compromise |
Utilize exploit protection to prevent activities which may be exploited through malicious web sites. |
|
| ICS | T0819 | Exploit Public-Facing Application |
Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application. [1] |
|
| ICS | T0820 | Exploitation for Evasion |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|
| ICS | T0890 | Exploitation for Privilege Escalation |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|
| ICS | T0866 | Exploitation of Remote Services |
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [2] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [3] Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted. |
|