What programs do you add to EMET?

A Guy · 17 Nov 2013

I have installed EMET and imported the two lists (I skipped the certificate list). I have added Sumatra PDF, but nothing else yet. I'm not sure what other programs I might want to add, or if anyone has had issues when adding certain programs to EMET. I can see the logic behind having Java, Adobe products, browsers, file compression utilities and pdf viewers as these are the most common vectors. But should I be looking at internet facing programs only, or? What about Flash? I always update flash the day a new version is available as I see it mentioned here, and several areas I surf. I have no Java or Adobe reader. I likely don't need EMET, and have system images always, but it seems to add no overhead, and I like my fortress of security

Any information would be appreciated. A Guy

Kari · 17 Nov 2013

EMET has been and is part of my security system, together with MSE (XP & 7) and Windows Defender(*) (8 & 8.1). I find this combination is enough for me, working well and using quite a little resources.

Using EMET, I recommend accepting and using the Recommend Settings i.e. adding protection for IE, WordPad, Office, Acrobat & Acrobat Reader and Java, and Trust Rules for MS online services (including Outlook.com / Live / Hotmail), Skype, Twitter, FB, Yahoo and such.

What programs do you add to EMET?-2013-11-17_140817.jpg

Additionally I add manually all browsers, email clients and programming applications (Visual Studio 2013, Windows Phone SDK and such).

This is of course only my personal way to use EMET, not necessarily the ideal or best way.

Kari

(*) = For those not familiar with Windows 8, the Windows Defender on 8 is not the same as Defender on 7. On 8 it is a complete AV program, replacing MSE which cannot be installed on 8.

grits · 18 Nov 2013

I've been thinking about EMET since this dang Crypto thing came about recently but most everything I read was over my head & confusing so was wondering if there was just a 'Recommended' setting that a n00b could get by with, Thanks Kari.

Callender · 24 Nov 2013

Personally I add internet facing applications that are not covered by the default list - in my case these include Opera-USB, Cyberfox, NitroPDF, S-Player and VLC.

You're not supposed to add Flash Player as it's covered under the plugin container(s) for whatever browser(s) you are using.

Example for Cyberfox browser:

Add wildcard entries for the program and the plugin container like this:

*\Cyberfox\plugin-container.exe
*\Cyberfox\Cyberfox.exe

If you need a guide that explains why flash player should not be added try reading through the guide available here:

Protecting your Windows PC with Microsoft EMET 3.0 - rationallyPARANOID.com

Note: The guide is for EMET 3.0 rather than the latest version but the advice on adding programs remains relevant even though the user interface has changed.

Any issues? Yes. Opera-USB browser needed to have the EAF protection disabled before it would work.

A Guy · 24 Nov 2013

Thanks Kari. Welcome to Seven Forums Callender, thanks for the added info.

So far I am just running with the defaults, and Sumatra.

A Guy