Implementing Memory Protection
FreeEnhance endpoint security with memory protection techniques.
Free · Opens the source repo
What Implementing Memory Protection does
This skill focuses on implementing essential memory protection mechanisms such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) to enhance security against memory corruption attacks. It provides a structured approach to hardening endpoints by configuring both system-wide and per-application mitigations, making it suitable for developers and security professionals looking to bolster their defenses against common exploit techniques like buffer overflows and return-oriented programming (ROP) chains.
The skill is designed for use in environments running Windows 10/11 or Windows Server 2016 and later, requiring administrative privileges for configuration. Users need to understand the implications of memory corruption attacks and have a test environment to validate application compatibility with the applied mitigations. The skill guides users through a series of PowerShell commands that enable and configure the various security features, ensuring that both system-level and application-specific settings are properly applied.
In addition to configuring DEP and ASLR, the skill also addresses common pitfalls associated with these mitigations, such as compatibility issues with legacy applications. This foresight helps users avoid potential disruptions in their workflows. Furthermore, it emphasizes the importance of testing applications for ASLR compatibility and understanding the limitations of CFG, which only applies to applications compiled with the necessary support. Overall, this skill is a valuable resource for those seeking to implement robust memory protection strategies in their software environments.
When to use it
Use this skill when you need to configure memory protection mechanisms to secure applications against various exploit techniques.
When not to use it
This skill may not be suitable if you are working in non-Windows environments or if your applications are incompatible with the applied mitigations.
What you can build with it
Securing High-Risk Applications
Use this skill to configure memory protection for applications like browsers and office software, which are often targeted by exploits.
Enterprise-Wide Deployment
Leverage this skill to set up memory protection measures across multiple endpoints in a corporate environment using Group Policy.
Testing Application Compatibility
Utilize this skill in a test environment to ensure that applications function correctly after applying memory protection settings.
How to install Implementing Memory Protection
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/implementing-memory-protection-with-dep-aslr --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Implementing Memory Protection with DEP and ASLR
When to Use
Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.
Prerequisites
- Windows 10/11 or Windows Server 2016+ with administrative privileges
- Group Policy management access for enterprise-wide deployment
- Understanding of memory corruption attack techniques (buffer overflow, ROP chains)
- Test environment for validating application compatibility with exploit mitigations
Workflow
Step 1: Configure System-Level Mitigations
# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn
# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON
# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy
Step 2: Configure Per-Application Mitigations
# Harden high-risk applications (browsers, Office, PDF readers)
Set-ProcessMitigation -Name "WINWORD.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "EXCEL.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "AcroRd32.exe" -Enable DEP,SEHOP,ForceRelocateImages,CFG
Set-ProcessMitigation -Name "chrome.exe" -Enable DEP,CFG,ForceRelocateImages
Set-ProcessMitigation -Name "msedge.exe" -Enable DEP,CFG,ForceRelocateImages
# Export configuration for deployment
Get-ProcessMitigation -RegistryConfigFilePath "C:\exploit_protection.xml"
# Deploy via Intune or GPO
Step 3: Deploy via Intune/GPO
Intune: Endpoint Security → Attack Surface Reduction → Exploit Protection
Import exploit_protection.xml template
GPO: Computer Configuration → Admin Templates → Windows Components
→ Windows Defender Exploit Guard → Exploit Protection
→ "Use a common set of exploit protection settings" → Enabled
→ Point to XML file on network share
Key Concepts
| Term | Definition |
|---|---|
| DEP | Marks memory pages as non-executable to prevent shellcode execution in data regions |
| ASLR | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |
| CFG | Validates indirect call targets at runtime to prevent control flow hijacking |
| SEHOP | Validates SEH chain integrity to prevent SEH-based exploitation |
Tools & Systems
- Windows Exploit Protection: Built-in per-process mitigation management
- EMET (legacy): Enhanced Mitigation Experience Toolkit (predecessor, now deprecated)
- ProcessMitigations PowerShell: Get/Set-ProcessMitigation cmdlets
Common Pitfalls
- DEP compatibility: Legacy 32-bit applications may crash with DEP AlwaysOn. Use OptOut with exceptions.
- Mandatory ASLR breaking apps: Some applications are not ASLR-compatible. Test before enforcing ForceRelocateImages.
- CFG limited to compiled-in support: CFG only works for applications compiled with /guard:cf. Cannot be retroactively applied.
Frequently asked questions about Implementing Memory Protection
Similar skills
GitHub Actions Hardening
Enhance the security of your GitHub Actions workflows.
Sensitive Logging Audit
Audit and fix sensitive data exposure in Python logging.
Android App Static Analysis
Automate security assessments of Android apps with MobSF.
Integrating DAST with OWASP ZAP
Seamlessly integrate dynamic security testing into CI/CD pipelines.
Implementing Runtime Security with Tetragon
Enhance Kubernetes security with eBPF-based observability.
Implementing Mobile Application Management
Secure enterprise data on mobile devices with app-level controls.