id: windows-dep-disabled

info:
  name: Data Execution Prevention (DEP) Not Enabled
  author: princechaddha
  severity: high
  description: Checks if Data Execution Prevention (DEP) is not fully enabled for all programs.
  impact: |
    Disabling DEP allows certain types of memory-based attacks, such as buffer overflows.
  remediation: |
    Enable DEP for all programs to enhance memory protection.
  tags: windows,security,dep,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $EnableDEP = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'EnableDEP' -ErrorAction SilentlyContinue).EnableDEP
      if ($EnableDEP -ne 2) {
        Write-Output 'DEP not fully enabled'
      }

    matchers:
      - type: word
        words:
          - "DEP not fully enabled"
# digest: 490a0046304402200442e48a693e4ac8d598d48bc73db2e9fd3316570b77e2ab6d4fca68fcc19a67022030f9564b0744d513e383d781317d3d185e5f730b6b8ac4169108a7f8c40e9844:922c64590222798bb761d5b6d8e72950