StigData/Archive/Windows.Defender/U_MS_Windows_Defender_Antivirus_STIG_V1R8_Manual-xccdf.xml
|
<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Windows_Defender_Antivirus" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-03-19">accepted</status><title>MS Windows Defender Antivirus Security Technical Implementation Guide</title><description>The Windows Defender Antivirus Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be send via e-mail to the following address: disa.stig_spt@mail.mil.</description><notice id="terms-of-use" xml:lang="en"></notice><reference href="https://cyber.mil"><dc:publisher>DISA</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 8 Benchmark Date: 24 Apr 2020</plain-text><version>1</version><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description><ProfileDescription></ProfileDescription></description><select idref="V-75147" selected="true" /><select idref="V-75151" selected="true" /><select idref="V-75153" selected="true" /><select idref="V-75155" selected="true" /><select idref="V-75157" selected="true" /><select idref="V-75159" selected="true" /><select idref="V-75161" selected="true" /><select idref="V-75163" selected="true" /><select idref="V-75167" selected="true" /><select idref="V-75207" selected="true" /><select idref="V-75209" selected="true" /><select idref="V-75211" selected="true" /><select idref="V-75213" selected="true" /><select idref="V-75215" selected="true" /><select idref="V-75217" selected="true" /><select idref="V-75219" selected="true" /><select idref="V-75221" selected="true" /><select idref="V-75223" selected="true" /><select idref="V-75225" selected="true" /><select idref="V-75227" selected="true" /><select idref="V-75229" selected="true" /><select idref="V-75231" selected="true" /><select idref="V-75233" selected="true" /><select idref="V-75235" selected="true" /><select idref="V-75237" selected="true" /><select idref="V-75239" selected="true" /><select idref="V-75241" selected="true" /><select idref="V-75243" selected="true" /><select idref="V-75245" selected="true" /><select idref="V-75247" selected="true" /><select idref="V-77965" selected="true" /><select idref="V-77967" selected="true" /><select idref="V-77969" selected="true" /><select idref="V-77971" selected="true" /><select idref="V-77973" selected="true" /><select idref="V-77975" selected="true" /><select idref="V-77977" selected="true" /><select idref="V-77979" selected="true" /><select idref="V-79965" selected="true" /><select idref="V-79967" selected="true" /><select idref="V-79971" selected="true" /></Profile><Group id="V-75147"><title>SRG-APP-000279</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89827r3_rule" severity="high" weight="10.0"><version>WNDF-AV-000001</version><title>Windows Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature.</title><description><VulnDiscussion>After enabling this feature, PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81759r4_fix">Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> "Configure Detection for Potentially Unwanted Applications" to "Enabled" and "Block".</fixtext><fix id="F-81759r4_fix" /><check system="C-74939r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block".
Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender If the value "PUAProtection" does not exist, this is a finding. If the value "PUAProtection" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-75151"><title>SRG-APP-000279</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89831r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000003</version><title>Windows Defender AV must be configured to automatically take action on all detected tasks.</title><description><VulnDiscussion>This policy setting allows you to configure whether Windows Defender automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action user-defined action and the signature-defined action. If you enable this policy setting Windows Defender does not automatically take action on the detected threats but prompts users to choose from the actions available for each threat. If you disable or do not configure this policy setting Windows Defender automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001243</ident><fixtext fixref="F-81763r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> "Turn off routine remediation" to "Disabled" or "Not Configured".</fixtext><fix id="F-81763r2_fix" /><check system="C-74943r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> "Turn off routine remediation" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender Criteria: If the value "DisableRoutinelyTakingAction" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75153"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89833r5_rule" severity="high" weight="10.0"><version>WNDF-AV-000004</version><title>Windows Defender AV must be configured to run and scan for malware and other potentially unwanted software.</title><description><VulnDiscussion>This policy setting turns off Windows Defender Antivirus. If you enable this policy setting Windows Defender Antivirus does not run and computers are not scanned for malware or other potentially unwanted software. When the setting is Disabled and a third-party antivirus solution is installed, the two applications can both simultaneously try to protect the system. The two AV solutions both attempt to quarantine the same threat and will fight for access to delete the file. Users will see conflicts and the system may lock up until the two solutions finish processing. When the setting is Not Configured and a third-party antivirus solution is installed, both applications co-exist on the system without conflicts. Defender Antivirus will automatically disable itself and will enable if the third-party solution stops functioning. When the setting is Not Configured and Defender Antivirus is the only AV solution, Defender AV will run (default state) and receive definition updates. An administrator account is needed to turn off the service. A standard user cannot disable the service. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81765r5_fix">For Windows 10: Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus set "Turn off Windows Defender Antivirus" to "Not Configured". For Windows 2016/Windows 2019: Use the following PowerShell cmdlet to uninstall Windows Defender AV on Windows 2016/Windows 2019: Uninstall-WindowsFeature -Name Windows-Defender </fixtext><fix id="F-81765r5_fix" /><check system="C-74945r6_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> "Turn off Windows Defender Antivirus" is set to “Not Configured”. For Windows 10: Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender Criteria: If the value "DisableAntiSpyware" does not exist, this is not a finding. For Windows Server 2016/Windows Server 2019: Note: This only applies when a third-party antivirus solution is enforced on the system. Due to changes from Microsoft in the Server 2016/Server 2019 architecture, Windows Defender Antivirus will not disable itself when other antivirus products are detected. Microsoft has also removed API's for other Antivirus software to cleanly stop and disable Windows Defender AV. This was a design choice by Microsoft to maximize protection in Server 2016/Server 2019. If there is a third-party antivirus product enforced on the system, the Windows Defender Antivirus must be uninstalled. Procedure: Access Add Roles and Features Wizard >> Features Criteria: If “Windows Defender Features (Installed) is selected, this is a finding. </check-content></check></Rule></Group><Group id="V-75155"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89835r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000005</version><title>Windows Defender AV must be configured to not exclude files for scanning.</title><description><VulnDiscussion>This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of a path or a fully qualified resource name. As an example a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81767r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Path Exclusions" to "Disabled" or "Not Configured".</fixtext><fix id="F-81767r2_fix" /><check system="C-74947r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Path Exclusions" is set to "Disabled" or "Not Configured. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions Criteria: If the value "Exclusions_Paths" does not exist, this is not a finding.</check-content></check></Rule></Group><Group id="V-75157"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89837r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000006</version><title>Windows Defender AV must be configured to not exclude files opened by specified processes.</title><description><VulnDiscussion>This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81769r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Process Exclusions" to "Disabled" or "Not Configured".</fixtext><fix id="F-81769r2_fix" /><check system="C-74949r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Process Exclusions" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions Criteria: If the value "Exclusions_Processes" does not exist, this is not a finding.</check-content></check></Rule></Group><Group id="V-75159"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89839r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000007</version><title>Windows Defender AV must be configured to enable the Automatic Exclusions feature.</title><description><VulnDiscussion>Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81771r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Turn off Auto Exclusions" to "Disabled".</fixtext><fix id="F-81771r1_fix" /><check system="C-74951r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Exclusions -> "Turn off Auto Exclusions" is set to "Disabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Exclusions Criteria: If the value "DisableAutoExclusions" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75161"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89841r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000008</version><title>Windows Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81773r4_fix">This is applicable to unclassified systems, for other systems this is NA. Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Configure local setting override for reporting to Microsoft MAPS" to "Disabled" or "Not Configured".</fixtext><fix id="F-81773r4_fix" /><check system="C-74953r5_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Configure local setting override for reporting to Microsoft MAPS" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "LocalSettingOverrideSpynetReporting" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75163"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89843r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000009</version><title>Windows Defender AV must be configured to check in real time with MAPS before content is run or accessed.</title><description><VulnDiscussion>This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled the check will not occur which will lower the protection state of the device. Enabled - The Block at First Sight setting is turned on. Disabled - The Block at First Sight setting is turned off. This feature requires these Group Policy settings to be set as follows: MAPS -> The "Join Microsoft MAPS" must be enabled or the "Block at First Sight" feature will not function. MAPS -> The "Send file samples when further analysis is required" should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. Real-time Protection -> The "Scan all downloaded files and attachments" policy must be enabled or the "Block at First Sight" feature will not function. Real-time Protection -> Do not enable the "Turn off real-time protection" policy or the "Block at First Sight" feature will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81775r3_fix">This is applicable to unclassified systems, for other systems this is NA. Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Configure the 'Block at First Sight' feature" to "Enabled".</fixtext><fix id="F-81775r3_fix" /><check system="C-74957r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Configure the 'Block at First Sight' feature" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75167"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89847r6_rule" severity="medium" weight="10.0"><version>WNDF-AV-000010</version><title>Windows Defender AV must be configured to join Microsoft MAPS.</title><description><VulnDiscussion>This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected including where the software came from the actions that you apply or that are applied automatically and whether the actions were successful. Advanced membership in addition to basic information will send more information to Microsoft about malicious software spyware and potentially unwanted software including the location of the software file names how the software operates and how it has impacted your computer. If you enable this setting you will join Microsoft MAPS with the membership specified. If you disable or do not configure this setting you will not join Microsoft MAPS. In Windows 10 Basic membership is no longer available so setting the value to 1 or 2 enrolls the device into Advanced membership. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81779r8_fix">This is applicable to unclassified systems, for other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> MAPS >> "Join Microsoft MAPS" to "Enabled" and select "Advanced MAPS" from the drop down box. </fixtext><fix id="F-81779r8_fix" /><check system="C-74959r7_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA. Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> MAPS >> "Join Microsoft MAPS" is set to "Enabled" and "Advanced MAPS" selected from the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "SpynetReporting" is REG_DWORD = 2, this is not a finding. </check-content></check></Rule></Group><Group id="V-75207"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89887r3_rule" severity="medium" weight="10.0"><version>WNDF-AV-000011</version><title>Windows Defender AV must be configured to only send safe samples for MAPS telemetry.</title><description><VulnDiscussion>This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: (0x0) Always prompt (0x1) Send safe samples automatically (0x2) Never send (0x3) Send all samples automatically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81859r4_fix">This is applicable to unclassified systems, for other systems this is NA. Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Send file samples when further analysis is required" to "Enabled" and select "Send safe samples" from the drop down box.</fixtext><fix id="F-81859r4_fix" /><check system="C-74999r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This is applicable to unclassified systems, for other systems this is NA. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> MAPS -> "Send file samples when further analysis is required" is set to "Enabled" and "Send safe samples" selected from the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "SubmitSamplesConsent" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-75209"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89889r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000012</version><title>Windows Defender AV must be configured for protocol recognition for network protection.</title><description><VulnDiscussion>This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities. If you enable or do not configure this setting protocol recognition will be enabled. If you disable this setting protocol recognition will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81819r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Network Inspection System -> "Turn on protocol recognition" to "Enabled" or "Not Configured".</fixtext><fix id="F-81819r2_fix" /><check system="C-75001r10_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Network Inspection System -> "Turn on protocol recognition" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\NIS Criteria: If the value "DisableProtocolRecognition" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75211"><title>SRG-APP-000112</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89891r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000013</version><title>Windows Defender AV must be configured to not allow local override of monitoring for file and program activity.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-81821r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for monitoring file and program activity on your computer" to "Disabled" or "Not Configured".</fixtext><fix id="F-81821r2_fix" /><check system="C-75003r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for monitoring file and program activity on your computer" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "LocalSettingOverrideDisableOnAccessProtection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75213"><title>SRG-APP-000112</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89893r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000014</version><title>Windows Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001695</ident><fixtext fixref="F-81823r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for monitoring for incoming and outgoing file activity" to "Disabled" or "Not Configured".</fixtext><fix id="F-81823r2_fix" /><check system="C-75005r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for monitoring for incoming and outgoing file activity" is set to "Disabled" or "Not Configure". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "LocalSettingOverrideRealtimeScanDirection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75215"><title>SRG-APP-000209</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89895r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000015</version><title>Windows Defender AV must be configured to not allow override of scanning for downloaded files and attachments.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001169</ident><fixtext fixref="F-81825r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for scanning all downloaded files and attachments" to "Disabled" or "Not Configured".</fixtext><fix id="F-81825r2_fix" /><check system="C-75007r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for scanning all downloaded files and attachments" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "LocalSettingOverrideDisableIOAVProtection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75217"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89897r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000016</version><title>Windows Defender AV must be configured to not allow override of behavior monitoring.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81827r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for turn on behavior monitoring" to "Disabled" or "Not Configured".</fixtext><fix id="F-81827r2_fix" /><check system="C-75009r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override for turn on behavior monitoring" is set to "Disabled" or "Not Configure". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "LocalSettingOverrideDisableBehaviorMonitoring" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75219"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89899r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000017</version><title>Windows Defender AV Group Policy settings must take priority over the local preference settings.</title><description><VulnDiscussion>This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. If you enable this setting the local preference setting will take priority over Group Policy. If you disable or do not configure this setting Group Policy will take priority over the local preference setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81829r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override to turn on real-time protection" to "Disabled" or "Not Configured".</fixtext><fix id="F-81829r2_fix" /><check system="C-75011r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure local setting override to turn on real-time protection" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "LocalSettingOverrideDisableRealtimeMonitoring" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75221"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89901r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000018</version><title>Windows Defender AV must monitor for incoming and outgoing files.</title><description><VulnDiscussion>This policy setting allows you to configure monitoring for incoming and outgoing files without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. Note that this configuration is only honored for NTFS volumes. For any other file system type full monitoring of file and program activity will be present on those volumes. The options for this setting are mutually exclusive: 0 = Scan incoming and outgoing files (default) 1 = Scan incoming files only 2 = Scan outgoing files only Any other value or if the value does not exist resolves to the default (0). If you enable this setting the specified type of monitoring will be enabled. If you disable or do not configure this setting monitoring for incoming and outgoing files will be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81831r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure monitoring for incoming and outgoing file and program activity" to "Disabled" or "Not Configured".</fixtext><fix id="F-81831r2_fix" /><check system="C-75013r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Configure monitoring for incoming and outgoing file and program activity" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "RealtimeScanDirection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1 or 2, this is a finding.</check-content></check></Rule></Group><Group id="V-75223"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89903r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000019</version><title>Windows Defender AV must be configured to monitor for file and program activity.</title><description><VulnDiscussion>This policy setting allows you to configure monitoring for file and program activity. If you enable or do not configure this setting monitoring for file and program activity will be enabled. If you disable this setting monitoring for file and program activity will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81833r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Monitor file and program activity on your computer" to "Enabled" or "Not Configured".</fixtext><fix id="F-81833r2_fix" /><check system="C-75015r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Monitor file and program activity on your computer to be scanned" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableOnAccessProtection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75225"><title>SRG-APP-000209</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89905r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000020</version><title>Windows Defender AV must be configured to scan all downloaded files and attachments.</title><description><VulnDiscussion>This policy setting allows you to configure scanning for all downloaded files and attachments. If you enable or do not configure this setting scanning for all downloaded files and attachments will be enabled. If you disable this setting scanning for all downloaded files and attachments will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001169</ident><fixtext fixref="F-81835r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Scan all downloaded files and attachments" to "Enabled" or "Not Configured".</fixtext><fix id="F-81835r2_fix" /><check system="C-75017r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Scan all downloaded files and attachments" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableIOAVProtection" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75227"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89907r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000021</version><title>Windows Defender AV must be configured to always enable real-time protection.</title><description><VulnDiscussion>This policy setting turns off real-time protection prompts for known malware detection. Windows Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. If you enable this policy setting Windows Defender Antivirus will not prompt users to take actions on malware detections. If you disable or do not configure this policy setting Windows Defender Antivirus will prompt users to take actions on malware detections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81837r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn off real-time protection" to "Disabled" or "Not Configured".</fixtext><fix id="F-81837r2_fix" /><check system="C-75019r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn off real-time protection" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableRealtimeMonitoring" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75229"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89909r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000022</version><title>Windows Defender AV must be configured to enable behavior monitoring.</title><description><VulnDiscussion>This policy setting allows you to configure behavior monitoring. If you enable or do not configure this setting behavior monitoring will be enabled. If you disable this setting behavior monitoring will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81839r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn on behavior monitoring" to "Enabled " or "Not Configured".</fixtext><fix id="F-81839r2_fix" /><check system="C-75021r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn on behavior monitoring" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableBehaviorMonitoring" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75231"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89911r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000023</version><title>Windows Defender AV must be configured to process scanning when real-time protection is enabled.</title><description><VulnDiscussion>This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. If you enable or do not configure this setting a process scan will be initiated when real-time protection is turned on. If you disable this setting a process scan will not be initiated when real-time protection is turned on.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81841r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> Turn on process scanning whenever real-time protection is enabled to "Enabled" or "Not Configured".</fixtext><fix id="F-81841r2_fix" /><check system="C-75023r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Real-time Protection -> "Turn on process scanning whenever real-time protection is enabled" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "DisableScanOnRealtimeEnable" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75233"><title>SRG-APP-000278</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89913r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000024</version><title>Windows Defender AV must be configured to scan archive files.</title><description><VulnDiscussion>This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. If you enable or do not configure this setting archive files will be scanned. If you disable this setting archive files will not be scanned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001242</ident><fixtext fixref="F-81843r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Scan archive files" to "Enabled " or "Not Configured".</fixtext><fix id="F-81843r2_fix" /><check system="C-75025r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Scan archive files" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan Criteria: If the value "DisableArchiveScanning" is REG_DWORD = 0, this is not a finding. If the value does not exist, this is not a finding. If the value is 1, this is a finding.</check-content></check></Rule></Group><Group id="V-75235"><title>SRG-APP-000073</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89915r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000025</version><title>Windows Defender AV must be configured to scan removable drives.</title><description><VulnDiscussion>This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives such as USB flash drives when running a full scan. If you enable this setting removable drives will be scanned during any type of scan. If you disable or do not configure this setting removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-000870</ident><fixtext fixref="F-81845r3_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Scan removable drives" to "Enabled".</fixtext><fix id="F-81845r3_fix" /><check system="C-75027r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Scan removable drives" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan Criteria: If the value "DisableRemovableDriveScanning" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75237"><title>SRG-APP-000277</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89917r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000026</version><title>Windows Defender AV must be configured to perform a weekly scheduled scan.</title><description><VulnDiscussion>This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never (default) If you enable this setting a scheduled scan will run at the frequency specified. If you disable or do not configure this setting a scheduled scan will run at a default frequency.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001241</ident><fixtext fixref="F-81847r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Specify the day of the week to run a scheduled scan" to "Enabled " and select anything other than "Never" in the drop down box.</fixtext><fix id="F-81847r2_fix" /><check system="C-75029r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Specify the day of the week to run a scheduled scan" is set to "Enabled" and anything other than "Never" selected in the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan Criteria: If the value "ScheduleDay" is REG_DWORD = 0x8, this is a finding. Values of 0x0 through 0x7 are acceptable and not a finding.</check-content></check></Rule></Group><Group id="V-75239"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89919r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000027</version><title>Windows Defender AV must be configured to turn on e-mail scanning.</title><description><VulnDiscussion>This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported for example: pst (Outlook) dbx mbx mime (Outlook Express) binhex (Mac). If you enable this setting e-mail scanning will be enabled. If you disable or do not configure this setting e-mail scanning will be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-81849r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Turn on e-mail scanning" to "Enabled".</fixtext><fix id="F-81849r2_fix" /><check system="C-75031r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Scan -> "Turn on e-mail scanning" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan Criteria: If the value "DisableEmailScanning" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75241"><title>SRG-APP-000276</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89921r2_rule" severity="high" weight="10.0"><version>WNDF-AV-000028</version><title>Windows Defender AV spyware definition age must not exceed 7 days.</title><description><VulnDiscussion>This policy setting allows you to define the number of days that must pass before spyware definitions are considered out of date. If definitions are determined to be out of date this state may trigger several additional actions including falling back to an alternative update source or displaying a warning icon in the user interface. By default this value is set to 14 days. If you enable this setting spyware definitions will be considered out of date after the number of days specified have passed without an update. If you disable or do not configure this setting spyware definitions will be considered out of date after the default number of days have passed without an update.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001240</ident><fixtext fixref="F-81851r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Define the number of days before spyware definitions are considered out of date" to "Enabled" and select "7" or less in the drop down box. Do not select a value of 0. This disables the option.</fixtext><fix id="F-81851r2_fix" /><check system="C-75033r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Define the number of days before spyware definitions are considered out of date" is set to "Enabled" and "7"or less selected in the drop down box (excluding "0", which is unacceptable). Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates Criteria: If the value "ASSignatureDue" is REG_DWORD = 7, this is not a finding. A value of 1 - 6 is also acceptable and not a finding. A value of 0 is a finding. A value higher than 7 is a finding.</check-content></check></Rule></Group><Group id="V-75243"><title>SRG-APP-000276</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89923r2_rule" severity="high" weight="10.0"><version>WNDF-AV-000029</version><title>Windows Defender AV virus definition age must not exceed 7 days.</title><description><VulnDiscussion>This policy setting allows you to define the number of days that must pass before virus definitions are considered out of date. If definitions are determined to be out of date this state may trigger several additional actions including falling back to an alternative update source or displaying a warning icon in the user interface. By default this value is set to 14 days. If you enable this setting virus definitions will be considered out of date after the number of days specified have passed without an update. If you disable or do not configure this setting virus definitions will be considered out of date after the default number of days have passed without an update.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001240</ident><fixtext fixref="F-81853r2_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Define the number of days before virus definitions are considered out of date" to "Enabled" and select "7" or less in the drop down box. Do not select a value of 0. This disables the option.</fixtext><fix id="F-81853r2_fix" /><check system="C-75035r4_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Define the number of days before virus definitions are considered out of date" is set to "Enabled" and "7" or less selected in the drop down box (excluding "0", which is unacceptable). Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates Criteria: If the value "AVSignatureDue" is REG_DWORD = 7, this is not a finding. A value of 1 - 6 is also acceptable and not a finding. A value of 0 is a finding. A value higher than 7 is a finding.</check-content></check></Rule></Group><Group id="V-75245"><title>SRG-APP-000261</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89925r2_rule" severity="medium" weight="10.0"><version>WNDF-AV-000030</version><title>Windows Defender AV must be configured to check for definition updates daily.</title><description><VulnDiscussion>This policy setting allows you to specify the day of the week on which to check for definition updates. The check can also be configured to run every day or to never run at all. This setting can be configured with the following ordinal number values: (0x0) Every Day (default) (0x1) Sunday (0x2) Monday (0x3) Tuesday (0x4) Wednesday (0x5) Thursday (0x6) Friday (0x7) Saturday (0x8) Never If you enable this setting the check for definition updates will occur at the frequency specified. If you disable or do not configure this setting the check for definition updates will occur at a default frequency.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001308</ident><fixtext fixref="F-81855r3_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Specify the day of the week to check for definition updates" to "Enabled" and select "Every Day" in the drop down box.</fixtext><fix id="F-81855r3_fix" /><check system="C-75037r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Signature Updates -> "Specify the day of the week to check for definition updates" is set to "Enabled" and "Every Day" is selected in the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Signature Update Criteria: If the value "ScheduleDay" is REG_DWORD = 0, this is not a finding.</check-content></check></Rule></Group><Group id="V-75247"><title>SRG-APP-000207</title><description><GroupDescription></GroupDescription></description><Rule id="SV-89927r3_rule" severity="medium" weight="10.0"><version>WNDF-AV-000031</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Severe.</title><description><VulnDiscussion>This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-81857r3_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the “Show…” option box and enter "5” in the ‘Value name’ field and enter “2" in the ‘Value’ field. </fixtext><fix id="F-81857r3_fix" /><check system="C-75039r3_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled". Click the “Show…” box option and verify the ‘Value name’ field contains a value of “5” and the ‘Value’ field contains a “2". A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction Criteria: If the value "5" is REG_SZ = 2 (or 3), this is not a finding. </check-content></check></Rule></Group><Group id="V-77965"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92661r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000032</version><title>Windows Defender AV must be configured to block executable content from email client and webmail.</title><description><VulnDiscussion>This rule blocks the following file types from being run or launched from an email seen in either Microsoft Outlook or webmail (such as Gmail.com or Outlook.com): Executable files (such as .exe, .dll, or .scr) Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) Script archive files</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84677r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550” and the Value to “1”.</fixtext><fix id="F-84677r1_fix" /><check system="C-77575r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77967"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92663r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000033</version><title>Windows Defender AV must be configured block Office applications from creating child processes.</title><description><VulnDiscussion>Office apps, such as Word or Excel, will not be allowed to create child processes. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84679r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “D4F940AB-401B-4EFC-AADC-AD5F3C50688A” and the Value to “1”.</fixtext><fix id="F-84679r1_fix" /><check system="C-77577r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: D4F940AB-401B-4EFC-AADC-AD5F3C50688A Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “D4F940AB-401B-4EFC-AADC-AD5F3C50688A” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77969"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92665r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000034</version><title>Windows Defender AV must be configured block Office applications from creating executable content.</title><description><VulnDiscussion>This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique. Extensions will be blocked from being used by Office apps. Typically these extensions use the Windows Scripting Host (.wsh files) to run scripts that automate certain tasks or provide user-created add-on features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84681r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “3B576869-A4EC-4529-8536-B80A7769E899” and the Value to “1”. </fixtext><fix id="F-84681r1_fix" /><check system="C-77579r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: 3B576869-A4EC-4529-8536-B80A7769E899 Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “3B576869-A4EC-4529-8536-B80A7769E899” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77971"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92667r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000035</version><title>Windows Defender AV must be configured to block Office applications from injecting into other processes.</title><description><VulnDiscussion>Office apps, such as Word, Excel, or PowerPoint, will not be able to inject code into other processes. This is typically used by malware to run malicious code in an attempt to hide the activity from antivirus scanning engines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84683r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84” and the Value to “1”. </fixtext><fix id="F-84683r1_fix" /><check system="C-77581r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77973"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92669r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000036</version><title>Windows Defender AV must be configured to impede JavaScript and VBScript to launch executables.</title><description><VulnDiscussion>JavaScript and VBScript scripts can be used by malware to launch other malicious apps. This rule prevents these scripts from being allowed to launch apps, thus preventing malicious use of the scripts to spread malware and infect machines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84685r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “D3E037E1-3EB8-44C8-A917-57927947596D” and the Value to “1”. </fixtext><fix id="F-84685r1_fix" /><check system="C-77583r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: D3E037E1-3EB8-44C8-A917-57927947596D Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “D3E037E1-3EB8-44C8-A917-57927947596D” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77975"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92671r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000037</version><title>Windows Defender AV must be configured to block execution of potentially obfuscated scripts.</title><description><VulnDiscussion>Malware and other threats can attempt to obfuscate or hide their malicious code in some script files. This rule prevents scripts that appear to be obfuscated from running. It uses the AntiMalwareScanInterface (AMSI) to determine if a script is potentially obfuscated, and then blocks such a script, or blocks scripts when an attempt is made to access them. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84687r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “5BEB7EFE-FD9A-4556-801D-275E5FFC04CC” and the Value to “1”. </fixtext><fix id="F-84687r1_fix" /><check system="C-77585r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “5BEB7EFE-FD9A-4556-801D-275E5FFC04CC” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77977"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92673r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000038</version><title>Windows Defender AV must be configured to block Win32 imports from macro code in Office.</title><description><VulnDiscussion>This rule blocks potentially malicious behavior by not allowing macro code to execute routines in the Win 32 dynamic link library (DLL). </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84689r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" to "Enabled”. Click ‘Show...’. Set the Value name to “92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B” and the Value to “1”. </fixtext><fix id="F-84689r1_fix" /><check system="C-77587r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> "Configure Attack Surface Reduction rules" is set to "Enabled”. Click ‘Show...’. Verify the rule ID in the Value name column and the desired state in the Value column is set as follows: Value name: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B Value: 1 Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value “92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B” is REG_SZ = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-77979"><title>SRG-APP-000210</title><description><GroupDescription></GroupDescription></description><Rule id="SV-92675r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000039</version><title>Windows Defender AV must be configured to prevent user and apps from accessing dangerous websites.</title><description><VulnDiscussion>Enable Windows Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams exploit-hosting sites and other malicious content on the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001170</ident><fixtext fixref="F-84691r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Network Protection -> "Prevent users and apps from accessing dangerous websites" to "Enabled” and select “Block" in the drop down box.</fixtext><fix id="F-84691r1_fix" /><check system="C-77589r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Network Protection -> "Prevent users and apps from accessing dangerous websites" is set to "Enabled” and “Block" selected in the drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection Criteria: If the value "EnableNetworkProtection" is REG_DWORD = 1, this is not a finding.</check-content></check></Rule></Group><Group id="V-79965"><title>SRG-APP-000207</title><description><GroupDescription></GroupDescription></description><Rule id="SV-94669r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000040</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level High.</title><description><VulnDiscussion>This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86769r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the “Show…” option box and enter "4” in the ‘Value name’ field and enter “2" in the ‘Value’ field. </fixtext><fix id="F-86769r1_fix" /><check system="C-79633r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled". Click the “Show…” box option and verify the ‘Value name’ field contains a value of “4” and the ‘Value’ field contains a “2". A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction Criteria: If the value "4" is REG_SZ = 2 (or 3), this is not a finding. </check-content></check></Rule></Group><Group id="V-79967"><title>SRG-APP-000207</title><description><GroupDescription></GroupDescription></description><Rule id="SV-94671r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000041</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Medium.</title><description><VulnDiscussion>This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86771r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the “Show…” option box and enter "2” in the ‘Value name’ field and enter “2" in the ‘Value’ field.</fixtext><fix id="F-86771r1_fix" /><check system="C-79635r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled". Click the “Show…” box option and verify the ‘Value name’ field contains a value of “2” and the ‘Value’ field contains a “2". A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction Criteria: If the value "2" is REG_SZ = 2 (or 3), this is not a finding.</check-content></check></Rule></Group><Group id="V-79971"><title>SRG-APP-000207</title><description><GroupDescription></GroupDescription></description><Rule id="SV-94675r1_rule" severity="medium" weight="10.0"><version>WNDF-AV-000042</version><title>Windows Defender AV must be configured for automatic remediation action to be taken for threat alert level Low.</title><description><VulnDiscussion>This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level. Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. Valid threat alert levels are: 1 = Low 2 = Medium 4 = High 5 = Severe Valid remediation action values are: 2 = Quarantine 3 = Remove 6 = Ignore</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls></description><reference><dc:title>DPMS Target Windows Defender Antivirus</dc:title><dc:publisher>DISA</dc:publisher><dc:type>DPMS Target</dc:type><dc:subject>Windows Defender Antivirus</dc:subject><dc:identifier>3249</dc:identifier></reference><ident system="http://iase.disa.mil/cci">CCI-001662</ident><fixtext fixref="F-86775r1_fix">Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the “Show…” option box and enter "1” in the ‘Value name’ field and enter “2" in the ‘Value’ field.</fixtext><fix id="F-86775r1_fix" /><check system="C-79637r1_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows Defender Antivirus.xml" /><check-content>Verify the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Threats -> "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled". Click the “Show…” box option and verify the ‘Value name’ field contains a value of “1” and the ‘Value’ field contains a “2". A value of “3” in the ‘Value’ field is more restrictive and also an acceptable value. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction Criteria: If the value "1" is REG_SZ = 2 (or 3), this is not a finding.</check-content></check></Rule></Group></Benchmark> |