View SCAP - Microsoft Defender Antivirus Security Technical Implementation Guide V2R3

c

Microsoft Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature.

RMF Control: SI-3
Severity: High
CCI: CCI-001243
Version: WNDF-AV-000001
Vuln IDs: V-213426
Rule IDs: SV-213426r823024_rule

After enabling this feature, PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.

Fix: F-14649r823023_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Configure Detection for Potentially Unwanted Applications" to "Enabled" and "Block".

b

Microsoft Defender AV must be configured to automatically take action on all detected tasks.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001243
Version: WNDF-AV-000003
Vuln IDs: V-213427
Rule IDs: SV-213427r823026_rule

This policy setting allows Microsoft Defender configuration to automatically take action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action user-defined action and the signature-defined action. If this policy setting is enabled, Microsoft Defender does not automatically take action on the detected threats but prompts users to choose from the actions available for each threat. If this policy setting is disabled or not configured, Microsoft Defender automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.

Fix: F-14650r823025_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Turn off routine remediation" to "Disabled" or "Not Configured".

c

Microsoft Defender AV must be configured to run and scan for malware and other potentially unwanted software.

RMF Control: SI-3
Severity: High
CCI: CCI-001242
Version: WNDF-AV-000004
Vuln IDs: V-213428
Rule IDs: SV-213428r823028_rule

This policy setting turns off Microsoft Defender Antivirus. If this policy setting is enabled, Microsoft Defender Antivirus does not run and computers are not scanned for malware or other potentially unwanted software. When the setting is disabled and a third-party antivirus solution is installed, the two applications can both simultaneously try to protect the system. The two AV solutions both attempt to quarantine the same threat and will fight for access to delete the file. Users will see conflicts and the system may lock up until the two solutions finish processing. When the setting is not configured and a third-party antivirus solution is installed, both applications coexist on the system without conflicts. Defender Antivirus will automatically disable itself and will enable if the third-party solution stops functioning. When the setting is not configured and Defender Antivirus is the only AV solution, Defender AV will run (default state) and receive definition updates. An administrator account is needed to turn off the service. A standard user cannot disable the service.

Fix: F-14651r823027_fix

For Windows 10: Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus "Turn off Microsoft Defender Antivirus" to "Not Configured".

b

Microsoft Defender AV must be configured to not exclude files for scanning.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000005
Vuln IDs: V-213429
Rule IDs: SV-213429r823030_rule

This policy setting allows disabling of scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. Exceptions can be made to allow file/folders that are impacting enterprise applications to be excluded from being scanned. All exclusions should be documented and approved.

Fix: F-14652r823029_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Exclusions >> "Path Exclusions" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to not exclude files opened by specified processes.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000006
Vuln IDs: V-213430
Rule IDs: SV-213430r823032_rule

This policy setting allows the disabling of scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.

Fix: F-14653r823031_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Exclusions >> "Process Exclusions" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to enable the Automatic Exclusions feature.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000007
Vuln IDs: V-213431
Rule IDs: SV-213431r823034_rule

This setting allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.

Fix: F-14654r823033_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Exclusions >> "Turn off Auto Exclusions" to "Disabled".

b

Microsoft Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000008
Vuln IDs: V-213432
Rule IDs: SV-213432r823036_rule

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14655r823035_fix

This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Configure local setting override for reporting to Microsoft MAPS" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to check in real time with MAPS before content is run or accessed.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000009
Vuln IDs: V-213433
Rule IDs: SV-213433r823038_rule

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. Enabled - The Block at First Sight setting is turned on. Disabled - The Block at First Sight setting is turned off. This feature requires these Group Policy settings to be set as follows: MAPS >> The "Join Microsoft MAPS" must be enabled or the "Block at First Sight" feature will not function. MAPS >> The "Send file samples when further analysis is required" should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. Real-time Protection >> The "Scan all downloaded files and attachments" policy must be enabled or the "Block at First Sight" feature will not function. Real-time Protection >> Do not enable the "Turn off real-time protection" policy or the "Block at First Sight" feature will not function.

Fix: F-14656r823037_fix

This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Configure the 'Block at First Sight' feature" to "Enabled".

b

Microsoft Defender AV must be configured to join Microsoft MAPS.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000010
Vuln IDs: V-213434
Rule IDs: SV-213434r823040_rule

This policy setting allows joining Microsoft MAPS. Microsoft MAPS is the online community that helps in choosing how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. Advanced membership will send, in addition to basic information, more information to Microsoft about malicious software spyware and potentially unwanted software, including the location of the software file names, how the software operates, and how it has impacted your computer. If this setting is enabled, you will join Microsoft MAPS with the membership specified. If this setting is disabled or do not configured, you will not join Microsoft MAPS. In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership.

Fix: F-14657r823039_fix

This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Join Microsoft MAPS" to "Enabled" and select "Advanced MAPS" from the drop-down box.

b

Microsoft Defender AV must be configured to only send safe samples for MAPS telemetry.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000011
Vuln IDs: V-213435
Rule IDs: SV-213435r823042_rule

This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: (0x0) Always prompt (0x1) Send safe samples automatically (0x2) Never send (0x3) Send all samples automatically

Fix: F-14658r823041_fix

This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Send file samples when further analysis is required" to "Enabled" and select "Send safe samples" from the drop-down box.

b

Microsoft Defender AV must be configured for protocol recognition for network protection.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000012
Vuln IDs: V-213436
Rule IDs: SV-213436r823044_rule

This policy setting allows the configuration of protocol recognition for network protection against exploits of known vulnerabilities. If this setting is enabled or not configured, protocol recognition will be enabled. If this setting is disabled, protocol recognition will be disabled.

Fix: F-14659r823043_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Network Inspection System >> "Turn on protocol recognition" to "Enabled" or "Not Configured".

b

Microsoft Defender AV must be configured to not allow local override of monitoring for file and program activity.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001695
Version: WNDF-AV-000013
Vuln IDs: V-213437
Rule IDs: SV-213437r823046_rule

This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14660r823045_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure local setting override for monitoring file and program activity on your computer" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001695
Version: WNDF-AV-000014
Vuln IDs: V-213438
Rule IDs: SV-213438r823048_rule

This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14661r823047_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure local setting override for monitoring for incoming and outgoing file activity" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to not allow override of scanning for downloaded files and attachments.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001169
Version: WNDF-AV-000015
Vuln IDs: V-213439
Rule IDs: SV-213439r823050_rule

This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14662r823049_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure local setting override for scanning all downloaded files and attachments" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to not allow override of behavior monitoring.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000016
Vuln IDs: V-213440
Rule IDs: SV-213440r823052_rule

This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14663r823051_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure local setting override for turn on behavior monitoring" to "Disabled" or "Not Configured".

b

Microsoft Defender AV Group Policy settings must take priority over the local preference settings.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000017
Vuln IDs: V-213441
Rule IDs: SV-213441r823054_rule

This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. If this setting is enabled, the local preference setting will take priority over Group Policy. If this setting is disabled or not configured, Group Policy will take priority over the local preference setting.

Fix: F-14664r823053_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure local setting override to turn on real-time protection" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must monitor for incoming and outgoing files.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000018
Vuln IDs: V-213442
Rule IDs: SV-213442r823056_rule

This policy setting allows the configuration of monitoring for incoming and outgoing files without having to turn off monitoring entirely. It is recommended for use on servers that have a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. Note that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only Any other value, or if the value does not exist, resolves to the default (0). If this setting is enabled, the specified type of monitoring will be enabled. If this setting is disabled or not configured, monitoring for incoming and outgoing files will be enabled.

Fix: F-14665r823055_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure monitoring for incoming and outgoing file and program activity" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to monitor for file and program activity.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000019
Vuln IDs: V-213443
Rule IDs: SV-213443r823058_rule

This policy setting allows configuration of monitoring for file and program activity. If this setting is enabled or not configured, monitoring for file and program activity will be enabled. If this setting is disabled, monitoring for file and program activity will be disabled.

Fix: F-14666r823057_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Monitor file and program activity on your computer" to "Enabled" or "Not Configured".

b

Microsoft Defender AV must be configured to scan all downloaded files and attachments.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001169
Version: WNDF-AV-000020
Vuln IDs: V-213444
Rule IDs: SV-213444r823060_rule

This policy setting allows configuration of scanning for all downloaded files and attachments. If this setting is enabled or not configured, scanning for all downloaded files and attachments will be enabled. If this setting is disabled, scanning for all downloaded files and attachments will be disabled.

Fix: F-14667r823059_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Scan all downloaded files and attachments" to "Enabled" or "Not Configured".

b

Microsoft Defender AV must be configured to always enable real-time protection.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000021
Vuln IDs: V-213445
Rule IDs: SV-213445r823062_rule

This policy setting turns off real-time protection prompts for known malware detection. Microsoft Defender Antivirus alerts when malware or potentially unwanted software attempts to install itself or to run on your computer. If this policy setting is enabled, Microsoft Defender Antivirus will not prompt users to take actions on malware detections. If this policy setting is disabled or not configured, Microsoft Defender Antivirus will prompt users to take actions on malware detections.

Fix: F-14668r823061_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Turn off real-time protection" to "Disabled" or "Not Configured".

b

Microsoft Defender AV must be configured to enable behavior monitoring.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000022
Vuln IDs: V-213446
Rule IDs: SV-213446r823063_rule

This policy setting allows configuration of behavior monitoring. If this setting is enabled or not configured, behavior monitoring will be enabled. If this setting is disabled, behavior monitoring will be disabled.

Fix: F-14669r820186_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> Real-time Protection >> "Turn on behavior monitoring" to "Enabled " or "Not Configured".

b

Microsoft Defender AV must be configured to process scanning when real-time protection is enabled.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000023
Vuln IDs: V-213447
Rule IDs: SV-213447r823065_rule

This policy setting allows the configuration of process scanning when real-time protection is turned on. This helps to catch malware, which could start when real-time protection is turned off. If this setting is enabled or not configured, a process scan will be initiated when real-time protection is turned on. If this setting is disabled, a process scan will not be initiated when real-time protection is turned on.

Fix: F-14670r823064_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Turn on process scanning whenever real-time protection is enabled" to "Enabled" or "Not Configured".

b

Microsoft Defender AV must be configured to scan archive files.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001242
Version: WNDF-AV-000024
Vuln IDs: V-213448
Rule IDs: SV-213448r823067_rule

This policy setting allows the configuration of scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. If this setting is enabled or not configured, archive files will be scanned. If this setting is disabled, archive files will not be scanned.

Fix: F-14671r823066_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Scan archive files" to "Enabled " or "Not Configured".

b

Microsoft Defender AV must be configured to scan removable drives.

RMF Control: MA-3
Severity: Medium
CCI: CCI-000870
Version: WNDF-AV-000025
Vuln IDs: V-213449
Rule IDs: SV-213449r823068_rule

This policy setting allows the management of whether or not to scan for malicious software and unwanted software in the contents of removable drives such as USB flash drives when running a full scan. If this setting is enabled, removable drives will be scanned during any type of scan. If this setting is disabled or not configured, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan.

Fix: F-14672r820195_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> Scan >> "Scan removable drives" to "Enabled".

b

Microsoft Defender AV must be configured to perform a weekly scheduled scan.

RMF Control: SI-3
Severity: Medium
CCI: CCI-001241
Version: WNDF-AV-000026
Vuln IDs: V-213450
Rule IDs: SV-213450r823070_rule

This policy setting allows specifying the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never (default) If this setting is enabled, a scheduled scan will run at the frequency specified. If this setting is disabled or not configured, a scheduled scan will run at a default frequency.

Fix: F-14673r823069_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Specify the day of the week to run a scheduled scan" to "Enabled " and select anything other than "Never" in the drop-down box.

b

Microsoft Defender AV must be configured to turn on e-mail scanning.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000027
Vuln IDs: V-213451
Rule IDs: SV-213451r823072_rule

This policy setting allows the configuration of e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx mbx mime (Outlook Express), binhex (Mac). If this setting is enabled, e-mail scanning will be enabled. If this setting is disabled or not configured, e-mail scanning will be disabled.

Fix: F-14674r823071_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on e-mail scanning" to "Enabled".

c

Microsoft Defender AV spyware definition age must not exceed 7 days.

RMF Control: SI-3
Severity: High
CCI: CCI-001240
Version: WNDF-AV-000028
Vuln IDs: V-213452
Rule IDs: SV-213452r823073_rule

This policy setting allows defining the number of days that must pass before spyware definitions are considered out of date. If definitions are determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default this value is set to 14 days. If this setting is enabled, spyware definitions will be considered out of date after the number of days specified have passed without an update. If this setting is disabled or not configured, spyware definitions will be considered out of date after the default number of days have passed without an update.

Fix: F-14675r820204_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> Signature Updates >> "Define the number of days before spyware definitions are considered out of date" to "Enabled" and select "7" or less in the drop-down box. Do not select a value of 0. This disables the option.

c

Microsoft Defender AV virus definition age must not exceed 7 days.

RMF Control: SI-3
Severity: High
CCI: CCI-001240
Version: WNDF-AV-000029
Vuln IDs: V-213453
Rule IDs: SV-213453r823075_rule

This policy setting allows defining the number of days that must pass before virus definitions are considered out of date. If definitions are determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. If this setting is enabled, virus definitions will be considered out of date after the number of days specified have passed without an update. If this setting is disabled or not configured, virus definitions will be considered out of date after the default number of days have passed without an update.

Fix: F-14676r823074_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Signature Updates >> "Define the number of days before virus definitions are considered out of date" to "Enabled" and select "7" or less in the drop-down box. Do not select a value of 0. This disables the option.

b

Microsoft Defender AV must be configured to check for definition updates daily.

RMF Control: SI-8
Severity: Medium
CCI: CCI-001308
Version: WNDF-AV-000030
Vuln IDs: V-213454
Rule IDs: SV-213454r823077_rule

This policy setting allows specifying the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never If this setting is enabled, the check for definition updates will occur at the frequency specified. If this setting is disabled or not configured, the check for definition updates will occur at a default frequency.

Fix: F-14677r823076_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Signature Updates >> "Specify the day of the week to check for definition updates" to "Enabled" and select "Every Day" in the drop-down box.

b

Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Severe.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001662
Version: WNDF-AV-000031
Vuln IDs: V-213455
Rule IDs: SV-213455r823079_rule

This policy setting allows the customization of which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore

Fix: F-14678r823078_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the "Show…" option box and enter "5" in the "Value name" field and enter "2" in the "Value" field.

b

Microsoft Defender AV must be configured to block executable content from email client and webmail.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000032
Vuln IDs: V-213456
Rule IDs: SV-213456r823081_rule

This rule blocks the following file types from being run or launched from an email seen in either Microsoft Outlook or webmail (such as Gmail.com or Outlook.com): Executable files (such as .exe, .dll, or .scr) Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) Script archive files

Fix: F-14679r823080_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" and the Value to "1".

b

Microsoft Defender AV must be configured block Office applications from creating child processes.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000033
Vuln IDs: V-213457
Rule IDs: SV-213457r823083_rule

Office apps, such as Word or Excel, will not be allowed to create child processes. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.

Fix: F-14680r823082_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" and the Value to "1".

b

Microsoft Defender AV must be configured block Office applications from creating executable content.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000034
Vuln IDs: V-213458
Rule IDs: SV-213458r823085_rule

This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. Extensions will be blocked from being used by Office apps. Typically these extensions use the Windows Scripting Host (.wsh files) to run scripts that automate certain tasks or provide user-created add-on features.

Fix: F-14681r823084_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "3B576869-A4EC-4529-8536-B80A7769E899" and the Value to "1".

b

Microsoft Defender AV must be configured to block Office applications from injecting into other processes.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000035
Vuln IDs: V-213459
Rule IDs: SV-213459r823087_rule

Office apps, such as Word, Excel, or PowerPoint, will not be able to inject code into other processes. This is typically used by malware to run malicious code in an attempt to hide the activity from antivirus scanning engines.

Fix: F-14682r823086_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84" and the Value to "1".

b

Microsoft Defender AV must be configured to impede JavaScript and VBScript to launch executables.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000036
Vuln IDs: V-213460
Rule IDs: SV-213460r823089_rule

JavaScript and VBScript scripts can be used by malware to launch other malicious apps. This rule prevents these scripts from being allowed to launch apps, thus preventing malicious use of the scripts to spread malware and infect machines.

Fix: F-14683r823088_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "D3E037E1-3EB8-44C8-A917-57927947596D" and the Value to "1".

b

Microsoft Defender AV must be configured to block execution of potentially obfuscated scripts.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000037
Vuln IDs: V-213461
Rule IDs: SV-213461r823091_rule

Malware and other threats can attempt to obfuscate or hide their malicious code in some script files. This rule prevents scripts that appear to be obfuscated from running. It uses the AntiMalwareScanInterface (AMSI) to determine if a script is potentially obfuscated and then blocks such a script or blocks scripts when an attempt is made to access them.

Fix: F-14684r823090_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC" and the Value to "1".

b

Microsoft Defender AV must be configured to block Win32 imports from macro code in Office.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000038
Vuln IDs: V-213462
Rule IDs: SV-213462r823093_rule

This rule blocks potentially malicious behavior by not allowing macro code to execute routines in the Win 32 dynamic link library (DLL).

Fix: F-14685r823092_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Attack Surface Reduction >> "Configure Attack Surface Reduction rules" to "Enabled". Click "Show...". Set the Value name to "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B" and the Value to "1".

b

Microsoft Defender AV must be configured to prevent user and apps from accessing dangerous websites.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001170
Version: WNDF-AV-000039
Vuln IDs: V-213463
Rule IDs: SV-213463r823095_rule

Enable Microsoft Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploit-hosting sites, and other malicious content on the internet.

Fix: F-14686r823094_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Windows Defender Exploit Guard >> Network Protection >> "Prevent users and apps from accessing dangerous websites" to "Enabled" and select "Block" in the drop-down box.

b

Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level High.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001662
Version: WNDF-AV-000040
Vuln IDs: V-213464
Rule IDs: SV-213464r823097_rule

This policy setting allows the customization of which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore

Fix: F-14687r823096_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the "Show…" option box and enter "4" in the "Value name" field and enter "2" in the "Value" field.

b

Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Medium.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001662
Version: WNDF-AV-000041
Vuln IDs: V-213465
Rule IDs: SV-213465r823099_rule

This policy setting allows the customization of which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore

Fix: F-14688r823098_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the "Show…" option box and enter "2" in the "Value name" field and enter "2" in the "Value" field.

b

Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Low.

RMF Control: SC-18
Severity: Medium
CCI: CCI-001662
Version: WNDF-AV-000042
Vuln IDs: V-213466
Rule IDs: SV-213466r823101_rule

This policy setting allows the customization of which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore

Fix: F-14689r823100_fix

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the "Show…" option box and enter "1" in the "Value name" field and enter "2" in the "Value" field.