SV-50043r6: The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Recommended Software must be enabled. | Windows 7 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Recommended Software must be enabled.

Description

Discussion Text

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002824

References

DPMS Target Windows 7 DISA DPMS Target Windows 7 1712

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:4299
# The Enhanced Mitigation Experience Toolkit (EMET) Default Protections for Recommended Software must be enabled.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\*\Reader\AcroRd32.exe'
# registry_object (registry_test)
function test_1 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Adobe\*\Reader\AcroRd32.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Adobe\*\Reader\AcroRd32.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Adobe\*\Reader\AcroRd32.exe') -eq '+EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Adobe\Acrobat*\Acrobat\Acrobat.exe'
# registry_object (registry_test)
function test_2 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Adobe\Acrobat*\Acrobat\Acrobat.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Adobe\Acrobat*\Acrobat\Acrobat.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Adobe\Acrobat*\Acrobat\Acrobat.exe') -eq '+EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\java.exe'
# registry_object (registry_test)
function test_3 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Java\jre*\bin\java.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Java\jre*\bin\java.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Java\jre*\bin\java.exe') -eq '-HeapSpray'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaw.exe'
# registry_object (registry_test)
function test_4 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Java\jre*\bin\javaw.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Java\jre*\bin\javaw.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Java\jre*\bin\javaw.exe') -eq '-HeapSpray'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\Java\jre*\bin\javaws.exe'
# registry_object (registry_test)
function test_5 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Java\jre*\bin\javaws.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Java\jre*\bin\javaws.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Java\jre*\bin\javaws.exe') -eq '-HeapSpray'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\EXCEL.EXE'
# registry_object (registry_test)
function test_6 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\EXCEL.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\EXCEL.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\EXCEL.EXE') -eq '+ASR asr_modules:flash*.ocx'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\INFOPATH.EXE'
# registry_object (registry_test)
function test_7 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\INFOPATH.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\INFOPATH.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\INFOPATH.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\LYNC.EXE'
# registry_object (registry_test)
function test_8 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\LYNC.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\LYNC.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\LYNC.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSACCESS.EXE'
# registry_object (registry_test)
function test_9 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\MSACCESS.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\MSACCESS.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\MSACCESS.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\MSPUB.EXE'
# registry_object (registry_test)
function test_10 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\MSPUB.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\MSPUB.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\MSPUB.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OIS.EXE'
# registry_object (registry_test)
function test_11 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\OIS.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\OIS.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\OIS.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\OUTLOOK.EXE'
# registry_object (registry_test)
function test_12 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\OUTLOOK.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\OUTLOOK.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\OUTLOOK.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\POWERPNT.EXE'
# registry_object (registry_test)
function test_13 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\POWERPNT.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\POWERPNT.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\POWERPNT.EXE') -eq '+ASR asr_modules:flash*.ocx'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\PPTVIEW.EXE'
# registry_object (registry_test)
function test_14 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\PPTVIEW.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\PPTVIEW.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\PPTVIEW.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VISIO.EXE'
# registry_object (registry_test)
function test_15 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\VISIO.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\VISIO.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\VISIO.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\VPREVIEW.EXE'
# registry_object (registry_test)
function test_16 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\VPREVIEW.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\VPREVIEW.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\VPREVIEW.EXE') -match '^$'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\OFFICE1*\WINWORD.EXE'
# registry_object (registry_test)
function test_17 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\OFFICE1*\WINWORD.EXE').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\OFFICE1*\WINWORD.EXE' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\OFFICE1*\WINWORD.EXE') -eq '+ASR asr_modules:flash*.ocx'))
}
# Verifies 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' has a value for '*\WindowsNT\Accessories\wordpad.exe'
# registry_object (registry_test)
function test_18 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults').GetValueKind('*\Windows NT\Accessories\wordpad.exe').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\Defaults' -Name '*\Windows NT\Accessories\wordpad.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty '*\Windows NT\Accessories\wordpad.exe') -match '^$'))
}
# Verifies EMET is installed
# registry_object (registry_test)
function test_19 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')))
}
# Verifies EMET 5.5 or higher is installed
# registry_object (registry_test)
function test_20 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\').GetValueKind('DisplayVersion').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\' -Name 'DisplayVersion' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DisplayVersion') -ge '5.5'))
}
# Verifies DEP is set to 'OptOut'
# wmi57_object (wmi57_test)
function test_21 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT dataexecutionprevention_supportpolicy FROM win32_operatingsystem' | Select-Object -First 1) | Select-Object -ExpandProperty 'dataexecutionprevention_supportpolicy') -eq '3')
}
# Verifies DEP is set to 'AlwaysOn'
# wmi57_object (wmi57_test)
function test_22 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT dataexecutionprevention_supportpolicy FROM win32_operatingsystem' | Select-Object -First 1) | Select-Object -ExpandProperty 'dataexecutionprevention_supportpolicy') -eq '1')
}
# Verifies SEHOP is on and configured correctly
# registry_object (registry_test)
function test_23 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel').GetValueKind('DisableExceptionChainValidation').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel' -Name 'DisableExceptionChainValidation' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DisableExceptionChainValidation') -eq 0))
}
# Verifies EMET is installed
# registry_object (registry_test)
function test_24 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')))
}

if (((test_1 -and test_2 -and test_3 -and test_4 -and test_5 -and test_6 -and test_7 -and test_8 -and test_9 -and test_10 -and test_11 -and test_12 -and test_13 -and test_14 -and test_15 -and test_16 -and test_17 -and test_18 -and test_19 -and test_20) -or ((test_21 -or test_22) -and test_23 -and test_24))) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Remediation

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Protections for Recommended Software" to "Enabled".

				Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available.   

				Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area.  The setting can then be re-enabled.