What it does. 'Implements memory protection mechanisms including DEP (Data Execution Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-memory-protection-with-dep-aslr, or copy the skill folder into ~/.claude/skills/implementing-memory-protection-with-dep-aslr/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-memory-protection-with-dep-aslr/SKILL.md

SKILL.md (verbatim)

name: implementing-memory-protection-with-dep-aslr
description: 'Implements memory protection mechanisms including DEP (Data Execution
  Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard),
  and other exploit mitigations to prevent memory corruption attacks. Use when hardening
  endpoints against buffer overflow exploits, ROP chains, and code injection. Activates
  for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG
  configuration.

  '
domain: cybersecurity
subdomain: endpoint-security
tags:
- endpoint
- memory-protection
- DEP
- ASLR
- exploit-mitigation
- CFG
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
mitre_attack:
- T1055
- T1547
- T1059
- T1036
- T1190

Implementing Memory Protection with DEP and ASLR

When to Use

Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.

Prerequisites

• Windows 10/11 or Windows Server 2016+ with administrative privileges
• Group Policy management access for enterprise-wide deployment
• Understanding of memory corruption attack techniques (buffer overflow, ROP chains)
• Test environment for validating application compatibility with exploit mitigations

Workflow

Step 1: Configure System-Level Mitigations

# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn

# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON

# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy

Step 2: Configure Per-Application Mitigations

# Harden high-risk applications (browsers, Office, PDF readers)
Set-ProcessMitigation -Name "WINWORD.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "EXCEL.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "AcroRd32.exe" -Enable DEP,SEHOP,ForceRelocateImages,CFG
Set-ProcessMitigation -Name "chrome.exe" -Enable DEP,CFG,ForceRelocateImages
Set-ProcessMitigation -Name "msedge.exe" -Enable DEP,CFG,ForceRelocateImages

# Export configuration for deployment
Get-ProcessMitigation -RegistryConfigFilePath "C:\exploit_protection.xml"
# Deploy via Intune or GPO

Step 3: Deploy via Intune/GPO

Intune: Endpoint Security → Attack Surface Reduction → Exploit Protection
  Import exploit_protection.xml template

GPO: Computer Configuration → Admin Templates → Windows Components
  → Windows Defender Exploit Guard → Exploit Protection
  → "Use a common set of exploit protection settings" → Enabled
  → Point to XML file on network share

Key Concepts

Tools & Systems

• Windows Exploit Protection: Built-in per-process mitigation management
• EMET (legacy): Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)
• ProcessMitigations PowerShell: Get/Set-ProcessMitigation cmdlets

Common Pitfalls

• DEP compatibility: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.
• Mandatory ASLR breaking apps: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.
• CFG limited to compiled-in support: CFG only works for applications compiled with /guard:cf. Cannot be retroactively applied.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Memory Protection Configuration Template

System-Level Mitigations

Per-Application Mitigations

Sign-Off

references/api-reference.md (verbatim)

API Reference: Implementing Memory Protection with DEP and ASLR

Windows PowerShell Commands

# Check system-wide mitigations
Get-ProcessMitigation -System
# Check specific process
Get-ProcessMitigation -Name chrome.exe
# Set system-wide DEP
Set-ProcessMitigation -System -Enable DEP
# Import XML policy
Set-ProcessMitigation -PolicyFilePath policy.xml
# Export current policy
Get-ProcessMitigation -RegistryConfigFilePath export.xml

Memory Protection Mechanisms

Linux ASLR Check

# Check ASLR level (0=off, 1=conservative, 2=full)
cat /proc/sys/kernel/randomize_va_space
# Enable full ASLR
echo 2 > /proc/sys/kernel/randomize_va_space

ELF Binary Check (checksec)

checksec --file=/usr/bin/target
# Or with readelf
readelf -l binary | grep GNU_STACK
readelf -d binary | grep BIND_NOW

GCC Compilation Flags

References

• Windows Exploit Protection: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection
• checksec: https://github.com/slimm609/checksec.sh
• ASLR: https://en.wikipedia.org/wiki/Address_space_layout_randomization

references/standards.md (verbatim)

Standards & References

• MITRE ATT&CK T1055: Process Injection - mitigated by DEP, CFG, ASLR
• CIS Benchmark Section 18.9: Exploit Protection configuration
• NIST 800-53 SI-16: Memory Protection
• Microsoft Exploit Protection: https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection

references/workflows.md (verbatim)

Workflows

Memory Protection Deployment

[Audit current mitigations: Get-ProcessMitigation -System]
  → [Enable system-level DEP, SEHOP, ASLR]
  → [Configure per-app mitigations for high-risk applications]
  → [Export XML, deploy via Intune/GPO]
  → [Test application compatibility] → [Monitor for crashes]
  → [Tune exceptions for incompatible apps]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.