M1050 Exploit Protection: ATT&CK Settings by Technique

Every unpatched flaw is a race, and exploit protection is what makes the attacker's exploit fail or crash while the patch is still on its way. MITRE ATT&CK v20 maps mitigation M1050 Exploit Protection to 12 techniques and sub-techniques, from drive-by compromise and public-facing application exploits to privilege escalation and system binary proxy execution. This guide works through that mapping as a control owner: which memory and process mitigations raise attacker cost against which technique, how to deploy them without breaking line-of-business software, where virtual patching fits, and how to prove coverage. It is for endpoint engineers, platform teams and detection engineers. The theory of ASLR, DEP and control flow integrity is covered in the Exploit Mitigations Guide, and evasion of endpoint tools in the EDR Evasion and Defence Guide; this page does not repeat them.

Key takeaways

M1050 buys time, not immunity. It makes exploitation of known and unknown flaws harder and noisier; M1051 Update Software still removes the flaw.
Four control families sit under M1050. ATT&CK lists operating system exploit protections, third-party endpoint exploit prevention, virtual patching with intrusion prevention, and hardening risky application features such as macros.
Some mitigations are on by default, the strong ones are not. DEP and heap integrity validation are on for modern 64-bit Windows processes; arbitrary code guard, code integrity guard and child process blocking must be set per application.
Audit first, but not everything can be audited. Microsoft documents no audit mode for CFG, mandatory ASLR, bottom-up ASLR or SEHOP, so those need a test ring rather than an audit period.
Appliances and SaaS need a different answer. Where you cannot run host mitigations, ATT&CK points to web application firewalls and intrusion prevention as the M1050 measure.

What M1050 is in ATT&CK v20

ATT&CK describes M1050 as deploying capabilities that detect, block and mitigate conditions indicative of software exploits. Its implementation text has four parts: enable built-in operating system protections such as DEP, ASLR and Control Flow Guard (on Windows through exploit protection, on Linux through kernel-level hardening such as SELinux and AppArmor); use endpoint tools with exploit detection and memory protection; apply virtual patches through intrusion prevention until the vendor patch is installed; and disable risky application features, for example blocking macros in Office documents downloaded from the internet.

Most of ATT&CK's per-technique usage text names Windows Defender Exploit Guard and the Enhanced Mitigation Experience Toolkit (EMET). EMET has been retired; on current Windows the equivalent built-in capability is exploit protection, configured under Microsoft Defender Exploit Guard in Group Policy.

D3FEND relates M1050 to four defensive techniques: D3-AH Application Hardening (making an executable more resilient to exploits that introduce new code or run unwanted existing code), D3-EHPV Exception Handler Pointer Validation, D3-SSC Shadow Stack Comparisons (comparing the call stack with a processor-maintained shadow stack) and D3-ITF Inbound Traffic Filtering, which is the virtual patching half of the mitigation.

Techniques ATT&CK says M1050 mitigates

All 12 current mappings in ATT&CK v20, grouped by tactic, with the measure that does the work. The middle column paraphrases ATT&CK; the right column is the NHI Mgmt Group view of the settings that apply.

Tactic	Technique	ATT&CK usage	Settings that raise cost
Initial Access	T1189 Drive-by Compromise	Exploit behaviour detection (WDEG, EMET)	Browser sandbox kept on, ACG and CFG for browsers that support them, block untrusted fonts, block remote images
Initial Access	T1190 Exploit Public-Facing Application	Web application firewalls limit exploit traffic reaching the application	WAF and IPS virtual patch rules; host mitigations on the web server process where the platform allows
Execution	T1203 Exploitation for Client Execution	Exploit behaviour detection	Don't allow child processes, code integrity guard, ACG for document readers and Office; macros from the internet blocked
Privilege Escalation	T1068 Exploitation for Privilege Escalation	Exploit behaviour detection	Disable Win32k system calls for processes that do not need GUI; Linux `kptr_restrict`, `dmesg_restrict`, `unprivileged_bpf_disabled`
Credential Access	T1212 Exploitation for Credential Access	Exploit behaviour detection	Hardware-enforced stack protection and CFG on authentication-facing processes
Stealth	T1211 Exploitation for Stealth	Exploit behaviour detection	Same memory mitigations on security tooling where its vendor supports them
Lateral Movement	T1210 Exploitation of Remote Services	Exploit behaviour detection	IPS signatures on internal segments, CFG and SEHOP on exposed services
Lateral Movement	T1080 Taint Shared Content	Utilities that mitigate common exploitation features (EMET)	Block remote images and block low integrity images for apps opening content from shares
Stealth	T1218 System Binary Proxy Execution	Attack surface reduction to block trusted binaries used to bypass application control	ASR rules and application control; see M1038
	T1218.010 Regsvr32	Block regsvr32.exe being used to bypass application control	Application control rules that restrict regsvr32
	T1218.011 Rundll32	Block methods of using rundll32.exe to bypass application control	Application control; ASR "Block use of copied or impersonated system tools"
	T1218.015 Electron Applications	Block methods of using trusted binaries to bypass application control	Keep Electron and the apps built on it updated (ATT&CK cites nodeIntegration bypasses); application control for the app binaries

The pattern is clear: eight of the 12 mappings concern exploitation, where memory mitigations and virtual patches break exploit reliability, and the four T1218 rows are really an application control problem that ATT&CK files here because EMET once carried an ASR feature. Treat the T1218 rows as joint work with M1038 Execution Prevention.

Windows exploit protection settings by purpose

Microsoft documents 22 exploit protection mitigations, applied per application through Image File Execution Options and taking effect when the program restarts. System settings apply to every app without an override; program settings apply only when "Override system settings" is selected. The table groups the ones that matter most.

Mitigation	Stops	Default (per Microsoft)	Audit mode
Data Execution Prevention (DEP)	Running code from data pages	On for x64, ARM and ARM64 processes and cannot be disabled; on for x86, can be disabled per process	Not listed
Control flow guard (CFG)	Indirect call hijacking	On for binaries compiled with CFG	No
Force randomisation for images (mandatory ASLR) and bottom-up ASLR	Predictable addresses for code reuse	Not stated; bottom-up requires mandatory ASLR	No
Validate exception chains (SEHOP)	SEH overwrite	Not stated	No
Validate heap integrity	Heap corruption	On for 64-bit apps and 32-bit apps targeting Vista or later	No
Hardware-enforced stack protection	Return address overwrite (needs CET or AMD shadow stacks)	Not stated	Yes
Arbitrary code guard (ACG)	Creating or modifying executable memory	Not stated; incompatible with JIT	Yes
Code integrity guard	Loading non-Microsoft-signed binaries	Not stated	Yes
Don't allow child processes	Exploit spawning a shell	Not stated	Yes
Disable Win32k system calls	Kernel attack surface from the process	Not stated	Yes
Block remote images, block low integrity images	Loading DLLs from UNC paths or downloaded files	Not stated	Yes

Two compatibility facts from Microsoft shape rollout: ACG is incompatible with SimExec, CallerCheck and StackPivot, and security software and API-interception tools are the products most often affected by IAF, SimExec, CallerCheck, StackPivot and EAF.

Linux and other platforms

Address space randomisation: kernel sysctl kernel.randomize_va_space set to 2 randomises mmap base, stack, VDSO and heap; 1 omits the heap; 0 disables randomisation. Alert on any host reporting less than 2.
Kernel information leaks: kernel.kptr_restrict 1 or 2 hides kernel pointers and kernel.dmesg_restrict 1 requires CAP_SYSLOG for dmesg, both of which make kernel exploits for T1068 less reliable.
Kernel attack surface: kernel.unprivileged_bpf_disabled set to 1 or 2 removes unprivileged bpf(); mandatory access control (SELinux or AppArmor) in enforcing mode limits what an exploited process can reach, as ATT&CK's M1050 text suggests.
Containers: keep the runtime's default seccomp profile and avoid privileged containers, so an exploited workload has fewer system calls to abuse.
Appliances and SaaS: you cannot install host mitigations on most VPN gateways, firewalls or SaaS. The M1050 measure there is virtual patching through WAF or IPS, plus exposure reduction. See the Virtual Patching and Compensating Controls Guide and the Web Application Firewall Guide.

How to implement M1050

Baseline. Run Get-ProcessMitigation -System on a reference image and record each system default. Inventory which line-of-business binaries are CFG-compiled (Microsoft suggests dumpbin /headers /loadconfig).
Pick the high-value processes. Browsers, Office, PDF readers, email clients, archive tools, script hosts and internet-facing server processes first, since they map to T1189, T1203 and T1190.
Audit where audit exists. Turn on audit for ACG, child process blocking, code integrity guard, low integrity and remote image blocking and Win32k system calls. Collect events from the Security-Mitigations log (audit event IDs 1, 3, 5, 7, 9 and 11) and application crash events 1000, 1001 and 1002.
Test ring for non-auditable settings. CFG, mandatory ASLR, bottom-up ASLR and SEHOP have no audit mode, so deploy them to a small test group with full user-mode dumps collected.
Enforce through central policy. Export the tested settings to XML and deploy through Intune (Attack surface reduction policy, Exploit Protection profile), the Policy CSP ./Device/Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings, Configuration Manager or the Group Policy setting "Use a common set of exploit protection settings". System-level changes need a restart; app-level changes do not.
Add virtual patches for exposure you cannot patch quickly. IPS or WAF rules for each newly disclosed flaw on internet-facing services, with an expiry date tied to the vendor patch.
Plan rollback. Microsoft warns that removing the GPO or MDM policy does not remove settings already written. Keep a reset XML (the Windows Security Baselines include EP-reset.xml) and test that it restores the default state.

Where identity fits

Exploits against identity-bearing processes are T1212 by definition, and ATT&CK's T1212 platforms include Identity Provider. Federation servers, authentication proxies, PAM jump hosts, secrets managers and CI runners all hold credentials for other systems, often non-human ones. They deserve the strictest process mitigations your vendor supports, with child process blocking on the service process where it never needs to spawn a shell. If one is exploited regardless, rotate the machine and service credentials it held, not just the patch. See the Service Account Security Guide.

What M1050 does not stop

Logic flaws and authentication bypasses: memory mitigations do nothing against a flaw that simply skips an authorisation check. The Ivanti Connect Secure chain began with an authentication bypass and command injection on an appliance where host mitigations could not be deployed; exploitation started around five weeks before disclosure and patches arrived three weeks after it. See the Ivanti Connect Secure exploitation breach analysis.
Interpreted and managed code: injection into PowerShell, Java or .NET applications runs inside a legitimate runtime; script controls and M1038 matter more.
Applications excluded for compatibility: any process with mitigations turned off is a preferred target; track overrides as risk exceptions.
Kernel driver abuse: loading a vulnerable signed driver is a separate problem; see the Bring Your Own Vulnerable Driver and EDR Killers Guide.
Stolen credentials: no exploit is needed when T1078 Valid Accounts works; that is identity control territory.

Detection and measurement

Mitigation coverage: percentage of high-value processes with the agreed mitigation set enforced, per platform.
Override count: apps with mitigations disabled, each with an owner and expiry.
Block and audit events: volume of Security-Mitigations events per week; a block on a browser or Office process is a high-priority alert.
Linux hardening drift: hosts where randomize_va_space is below 2 or kptr_restrict is 0.
Virtual patch latency: hours from disclosure of an internet-facing flaw to an active IPS or WAF rule, and rules still active after the patch landed.
Crash rate after rollout: application crash events 1000 and 1001 per ring, to show compatibility is under control.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev 5	SI-16 Memory Protection; CM-7 Least Functionality	Memory protections such as DEP and ASLR; disabling unneeded features such as macros.
NIST CSF 2.0	PR.PS-01 Configuration management practices	Exploit protection baselines are configuration managed.
CIS Controls v8.1	Safeguard 10.5 Enable Anti-Exploitation Features	Direct match for M1050.
ISO/IEC 27001:2022	Annex A 8.9 Configuration management	Secure configuration of hardware and software.
MITRE D3FEND	D3-AH, D3-EHPV, D3-SSC, D3-ITF	The defensive techniques D3FEND relates to M1050.

Common failure patterns

Relying on defaults: DEP and heap validation are on, so the team assumes exploit protection is done, while ACG, child process blocking and code integrity guard were never set for browsers or Office.
Enforce without a test ring: CFG or mandatory ASLR forced across the fleet, a line-of-business app crashes, and the whole policy is rolled back.
Removing the policy and assuming it is gone: settings written to IFEO stay behind, leaving inconsistent states nobody can explain.
Permanent exceptions: overrides granted during an incident and never reviewed.
Virtual patches without expiry: IPS rules left as the only control for months, with the real patch never scheduled.
Ignoring the edge: heavy endpoint hardening while VPN and firewall appliances, which cannot run host mitigations, wait weeks for patches.

Practitioner checklist

Record system-level exploit protection defaults on every reference image.
List high-value processes and the mitigation set each should run.
Audit ACG, child process, code integrity and image load mitigations before enforcing.
Test CFG, ASLR and SEHOP changes in a crash-monitored ring.
Deploy enforced settings from one XML through central policy, with a reset XML ready.
Set Linux randomize_va_space to 2, restrict kernel pointers and dmesg, and alert on drift.
Write virtual patches for exposed flaws with an expiry linked to the vendor patch.
Track overrides as risk exceptions with owners and review dates.
Send Security-Mitigations events to the SIEM and alert on blocks in browsers and Office.

M1050 Exploit Protection: Settings That Raise Attacker Cost by Technique