pinkpixel-dev/implementing-memory-protection-with-dep-aslr
SKILLS/implementing-memory-protection-with-dep-aslr/SKILL.md
Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 implementing-memory-protection-with-dep-aslrInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 4:20 AM212.9s7 files scanned
SKILL.md
- name:
- implementing-memory-protection-with-dep-aslr
- description:
- >
- domain:
- cybersecurity
- subdomain:
- endpoint-security
- tags:
- [endpoint, memory-protection, DEP, ASLR, exploit-mitigation, CFG]
- version:
- 1.0.0
- author:
- mahipal
- license:
- Apache-2.0
Implementing Memory Protection with DEP and ASLR
When to Use
Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.
Prerequisites
- Windows 10/11 or Windows Server 2016+ with administrative privileges
- Group Policy management access for enterprise-wide deployment
- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)
- Test environment for validating application compatibility with exploit mitigations
Workflow
Step 1: Configure System-Level Mitigations
# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn
# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON
# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy
Step 2: Configure Per-Application Mitigations
# Harden high-risk applications (browsers, Office, PDF readers)
Set-ProcessMitigation -Name "WINWORD.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "EXCEL.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "AcroRd32.exe" -Enable DEP,SEHOP,ForceRelocateImages,CFG
Set-ProcessMitigation -Name "chrome.exe" -Enable DEP,CFG,ForceRelocateImages
Set-ProcessMitigation -Name "msedge.exe" -Enable DEP,CFG,ForceRelocateImages
# Export configuration for deployment
Get-ProcessMitigation -RegistryConfigFilePath "C:\exploit_protection.xml"
# Deploy via Intune or GPO
Step 3: Deploy via Intune/GPO
Intune: Endpoint Security → Attack Surface Reduction → Exploit Protection
Import exploit_protection.xml template
GPO: Computer Configuration → Admin Templates → Windows Components
→ Windows Defender Exploit Guard → Exploit Protection
→ "Use a common set of exploit protection settings" → Enabled
→ Point to XML file on network share
Key Concepts
| Term | Definition | |------|-----------| | DEP | Marks memory pages as non-executable to prevent shellcode execution in data regions | | ASLR | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets | | CFG | Validates indirect call targets at runtime to prevent control flow hijacking | | SEHOP | Validates SEH chain integrity to prevent SEH-based exploitation |
Tools & Systems
- Windows Exploit Protection: Built-in per-process mitigation management
- EMET (legacy): Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)
- ProcessMitigations PowerShell: Get/Set-ProcessMitigation cmdlets
Common Pitfalls
- DEP compatibility: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.
- Mandatory ASLR breaking apps: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.
- CFG limited to compiled-in support: CFG only works for applications compiled with /guard:cf. Cannot be retroactively applied.
Related Skills
pinkpixel-dev/performing-cryptographic-audit-of-application
development
VerifiedTrustedCommunity
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-credential-access-with-lazagne
tools
VerifiedTrustedCommunity
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-content-security-policy-bypass
testing
VerifiedTrustedCommunity
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-container-security-scanning-with-trivy
testing
VerifiedTrustedCommunity
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
1SKILL.mdUpdated Jul 15, 2026