SANS ISC: Microsoft EMET 5.2 is available - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Microsoft has announced a new release of the Enhanced Mitigation Experience Toolkit (EMET) 5.2.

The main the main changes and improvements as the following:

• Control Flow Guard: EMET’s native DLLs have been compiled with Control Flow Guard (CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we strongly encourage 3^rd party developers to recompile their application to take advantage of this very latest security technology, we have compiled EMET with CFG.

• VBScript in Attack Surface Reduction: the configuration for the Attack Surface Reduction (ASR) mitigation has been improved to stop attempts to run the VBScript extension when loaded in the Internet Explorer's Internet Zone. This would mitigate the exploitation technique known as “VBScript God Mode” observed in recent attacks

========================================================================

1- http://blogs.technet.com/b/srd/archive/2015/03/12/emet-5-2-is-available.aspx

2- https://technet.microsoft.com/en-us/security/jj653751