From asi
Configures Windows memory protections like DEP, ASLR, CFG via PowerShell, GPO, and Intune to harden endpoints against buffer overflows, ROP chains, and code injection.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.
Configures Windows DEP, ASLR, CFG mitigations via PowerShell, GPO, Intune to protect endpoints from buffer overflows, ROP, code injection exploits.
Implements DEP, ASLR, CFG, and Windows Exploit Protection mitigations via PowerShell to harden endpoints against buffer overflows, ROP chains, and code injection.
Configures Microsoft Defender for Endpoint advanced settings including ASR rules, controlled folder access, network protection, and exploit protection for hardening Windows endpoints.
Share bugs, ideas, or general feedback.
Use this skill when hardening endpoints against memory-based exploits by configuring DEP, ASLR, CFG, and Windows Exploit Protection system-wide and per-application mitigations.
# Enable system-wide DEP (Data Execution Prevention)
# Boot configuration: OptIn (default), OptOut (recommended), AlwaysOn
bcdedit /set nx AlwaysOn
# Verify ASLR status (enabled by default on modern Windows)
Get-ProcessMitigation -System
# MandatoryASLR, BottomUpASLR, HighEntropyASLR should be ON
# Enable all system-level mitigations
Set-ProcessMitigation -System -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy
# Harden high-risk applications (browsers, Office, PDF readers)
Set-ProcessMitigation -Name "WINWORD.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "EXCEL.EXE" -Enable DEP,SEHOP,ForceRelocateImages,CFG,StrictHandle
Set-ProcessMitigation -Name "AcroRd32.exe" -Enable DEP,SEHOP,ForceRelocateImages,CFG
Set-ProcessMitigation -Name "chrome.exe" -Enable DEP,CFG,ForceRelocateImages
Set-ProcessMitigation -Name "msedge.exe" -Enable DEP,CFG,ForceRelocateImages
# Export configuration for deployment
Get-ProcessMitigation -RegistryConfigFilePath "C:\exploit_protection.xml"
# Deploy via Intune or GPO
Intune: Endpoint Security → Attack Surface Reduction → Exploit Protection
Import exploit_protection.xml template
GPO: Computer Configuration → Admin Templates → Windows Components
→ Windows Defender Exploit Guard → Exploit Protection
→ "Use a common set of exploit protection settings" → Enabled
→ Point to XML file on network share
| Term | Definition |
|---|---|
| DEP | Marks memory pages as non-executable to prevent shellcode execution in data regions |
| ASLR | Randomizes memory addresses of loaded modules to defeat hardcoded ROP gadgets |
| CFG | Validates indirect call targets at runtime to prevent control flow hijacking |
| SEHOP | Validates SEH chain integrity to prevent SEH-based exploitation |