Section 10: Application Control and Exploit Protection

The Big Picture: Two Different Questions

By now you have seen walls that keep things apart, and guards that look for bad files. This section covers two last layers that ask different questions:

Antivirus works by recognising bad. Application control works the other way: it only lets known good run. That is a much stronger idea, but harder to manage.

10.1 WDAC / AppLocker Concept

What it is: Application control is a set of rules that decide which programs, DLLs, scripts and installers may run on a PC. Anything not allowed is blocked, even if it is not known malware. Windows has two main tools.

What rules can look at:

How the decision works:

 User starts a program
        │
        ▼
 ┌─────────────────────────────┐
 │ Application control policy  │
 │ (allow list + deny rules)   │
 └──────────────┬──────────────┘
                │
        ┌───────┴────────┐
 matches an allow rule?  │
        │ yes            │ no
        ▼                ▼
   ┌─────────┐     ┌───────────────┐
   │ RUNS    │     │ BLOCKED       │
   └─────────┘     │ (event logged)│
                   └───────────────┘

Audit mode first. Good practice is to start a policy in audit mode: it only logs what would have been blocked, and blocks nothing. After you review the log, you switch to enforce mode. This avoids breaking things.

Related feature: S mode. Windows in S mode only runs apps from the Microsoft Store, using an application control policy built in to Windows. You can leave S mode, but you cannot go back.

Where you meet it:

Smart App Control (Windows 11, hedge). A consumer feature, available on some clean installs of Windows 11. It blocks untrusted or unsigned apps using a cloud reputation check plus code signing. It starts in an evaluation mode and turns itself on or off depending on how you use the PC. Once turned off, it normally cannot be turned back on without a reset (depends on version).

Edition note (hedge). AppLocker rule enforcement and some WDAC management options are mainly for Enterprise and Education (and in some cases Pro). Availability changes between versions, so check Microsoft's current documentation before planning anything.

Warning: A badly made policy can stop Windows apps or even prevent normal boot. Never experiment with application control on your only PC. Use a test machine or a virtual machine.

10.2 Exploit Protection Mitigations (DEP, ASLR, CFG)

The problem. Most programs have bugs. Some bugs let an attacker feed the program specially crafted data that makes it run the attacker's own instructions. Using a bug like this is called an exploit. The most common kind is a memory-corruption bug: the program writes outside the place it should, and overwrites something important, like a stored return address (Chapter 3 covers memory layout, the stack and the heap).

You cannot fix every bug. So Windows adds mitigations: built-in features that make exploiting a bug harder, or break the exploit entirely.

The main mitigations:

 Without ASLR                          With ASLR
 Attacker knows:                       Every launch is different:
 "useful code is at 0x7FFA1000"        launch 1:  0x7FFA1000
 ───► exploit works every time         launch 2:  0x7FF5C000
                                       launch 3:  0x7FF9E000
                                       ───► attacker must guess

 Without DEP:  attacker's data  ──► runs as code   (bad)
 With DEP:     attacker's data  ──► CPU says "this is data, not code"
                                    ──► program stops, nothing runs

Why layers matter. Each mitigation can be defeated on its own. Together they force an attacker to chain several tricks, and a single failure makes the exploit crash instead of succeed.

Where you control them:

Most mitigations are on by default for the system. Many modern programs also opt in on their own when they are built (compiled with ASLR and CFG support).

Extra layer: Windows Defender Exploit Guard (history). Microsoft once packaged these features under the name Exploit Guard (exploit protection, attack surface reduction rules, network protection and controlled folder access). The names changed over time; today you find them inside Windows Security and Microsoft Defender settings.

Attack Surface Reduction (ASR) rules (a brief taste). Defender has optional rules that block risky behaviour, for example "Block Office applications from creating child processes" or "Block credential stealing from LSASS". They are mostly used in managed environments. Availability depends on edition and settings.

Windows tip: If an old program crashes right after you enable a stricter exploit protection setting, you can set an exception for that one program instead of switching the protection off for everyone.

Do not turn mitigations off "to test". They are not slow. Weakening them reduces your safety for little gain.

Summary