What changed in Microsoft Defender Antivirus SCAP Benchmark V2R10V2R10 changes

Check text

AND - oval:mil.disa.stig.defenderantivirus:tst:1000 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "PUAProtection"; key equals "Software\\Policies\\Microsoft\\Windows Defender" state registry_state: type equals "reg_dword"; value equals "1" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block". Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender If the value "PUAProtection" does not exist, this is a finding. If the value "PUAProtection" is REG_DWORD = 1, this is not a finding.

V-213426 in V2R10

Check text

AND - oval:mil.disa.stig.defenderantivirus:tst:17000 registry_test (check: all, existence: any_existat_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "RealtimeScanDirection"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" state registry_state: type equals "reg_dword"; value equals "0" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure monitoring for incoming and outgoing file and program activity" is set to "Enabled" with a policy option value of "bi-directional (full on-access)". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection Criteria: If the value "RealtimeScanDirection" is REG_DWORD = 0, this is not a finding. If the value is 1 or 2, this is a finding.

V-213442 in V2R10

Check text

ANDOR - oval:mil.disa.stig.defenderantivirus:tst:18000HKLM\Software\Policies\Microsoft\Windows Defender\Policy Manager\AllowOnAccessProtection=1 registry_test (check: all, existence: any_existat_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "DisableOnAccessProtectionAllowOnAccessProtection"; key case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-TimePolicy ProtectionManager" state registry_state: type equals "reg_dword"; value equals "01" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real AND -time ProtectionSet >>by "MonitorGPO registry_test file(check: andall, programexistence: activityany_exist) object onregistry_object: yourhive computercase toinsensitive beequals scanned"HKEY_LOCAL_MACHINE"; isname setcase toinsensitive "Enabled"equals or "Not ConfiguredDisableOnAccessProtection". ; Procedure:key Usecase theinsensitive Windowsequals Registry Editor to navigate to the following key: HKLM\"Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" Criteria state registry_state: Iftype theequals "reg_dword"; value equals "DisableOnAccessProtection0" - isHKLM\Software\Policies\Microsoft\Windows REG_DWORDDefender\Policy =Manager\AllowOnAccessProtection 0,does thisnot isexist registry_test not(check: aall, finding.existence: none_exist) If object theregistry_object: valuehive doescase notinsensitive exist,equals this"HKEY_LOCAL_MACHINE"; isname notcase ainsensitive finding. Ifequals the"AllowOnAccessProtection"; valuekey iscase 1,insensitive thisequals is"Software\\Policies\\Microsoft\\Windows aDefender\\Policy finding.Manager"

V-213443 in V2R10

Check text

ANDOR - oval:milIntue has enabled the Real-Time Protection to scan all downloads and attachments.disa.stig.defenderantivirus:tst:19000 registry_test (check: all, existence: any_existat_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "DisableIOAVProtectionAllowIOAVProtection"; key case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-TimePolicy ProtectionManager" state registry_state: type equals "reg_dword"; value equals "01" Verify AND - theGPO policysetting value for 'Computer Configuration >> \Administrative Templates >> \Windows Components >> \Microsoft Defender Antivirus >> \Real-time Protection >> "\Scan all downloaded files and attachments"' is set to "'Enabled"' or "'Not Configured"'. registry_test (check: all, existence: any_exist) Procedure object registry_object: Usehive thecase Windowsinsensitive Registryequals Editor"HKEY_LOCAL_MACHINE"; toname navigatecase toinsensitive theequals following"DisableIOAVProtection"; key: HKLM\case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" Criteria state registry_state: Iftype theequals value "DisableIOAVProtectionreg_dword"; isvalue REG_DWORDequals = "0," - thisIntune is not a findingused. registry_test (check: all, existence: none_exist) If object theregistry_object: valuehive doescase notinsensitive exist,equals this"HKEY_LOCAL_MACHINE"; isname notcase ainsensitive finding. Ifequals the"AllowIOAVProtection"; valuekey iscase 1,insensitive thisequals is"Software\\Policies\\Microsoft\\Windows aDefender\\Policy finding.Manager"

V-213444 in V2R10

Check text

ANDOR - oval:milIntune has real-time protection enabled.disa.stig.defenderantivirus:tst:20000 registry_test (check: all, existence: any_existat_least_one_exists) object registry_object: hive case insensitive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "DisableRealtimeMonitoringAllowRealtimeMonitoring"; key case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-TimePolicy ProtectionManager" state registry_state: type equals "reg_dword"; value equals "01" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real AND -time Protection >> "'Turn off real-time protection"' is setnot configured or det to "Disabled"'disabled' orby "Notthe Configured".GPO registry_test (check: all, existence: any_exist) Procedure object registry_object: Usehive thecase Windowsinsensitive Registryequals Editor"HKEY_LOCAL_MACHINE"; toname navigatecase toinsensitive theequals following"DisableRealtimeMonitoring"; key: HKLM\case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" Criteria state registry_state: Iftype theequals "reg_dword"; value equals "DisableRealtimeMonitoring0" - The setting is REG_DWORDnot =configured 0,by thisIntune registry_test is(check: notall, aexistence: finding.none_exist) If object theregistry_object: valuehive doescase notinsensitive exist,equals this"HKEY_LOCAL_MACHINE"; isname notcase ainsensitive finding. Ifequals the"AllowRealtimeMonitoring"; valuekey iscase 1,insensitive thisequals is"Software\\Policies\\Microsoft\\Windows aDefender\\Policy finding.Manager"

V-213445 in V2R10

Check text

ANDOR - oval:mil.disa.stig.defenderantivirus:tst:21000Behavior monitoring is enabled by Intune registry_test (check: all, existence: any_existat_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableBehaviorMonitoringAllowBehaviorMonitoring"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-TimePolicy ProtectionManager" state registry_state: type equals "reg_dword"; value equals "01" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real AND -time ProtectionBehavior >> "Turn on behavior monitoring" is setenabled toby "Enabled" or "Not Configured".GPO registry_test Procedure(check: Useall, theexistence: Windowsany_exist) object Registryregistry_object: Editorhive toequals navigate"HKEY_LOCAL_MACHINE"; toname theequals following"DisableBehaviorMonitoring"; key: HKLM\equals "Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" Criteria state registry_state: Iftype theequals value "DisableBehaviorMonitoringreg_dword"; isvalue REG_DWORDequals = "0," - thisBehavior monitoring is not aset finding.by Intune If registry_test the(check: value does not existall, thisexistence: isnone_exist) object notregistry_object: ahive finding. Ifequals the"HKEY_LOCAL_MACHINE"; valuename isequals 1,"AllowBehaviorMonitoring"; thiskey isequals a"Software\\Policies\\Microsoft\\Windows finding.Defender\\Policy Manager"

V-213446 in V2R10

Check text

ANDOR AND - ovalGroup Policy:mil.disa.stig.defenderantivirus:tst:23000 Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Scan\Scan archive files is set to '0' registry_test (check: all, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableArchiveScanning"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value equals "0" Verify - Ensure the policyIntune valueEquivalent foris Computernot ConfigurationContradicting registry_test >>(check: Administrativenone Templatessatisfy, >>existence: Windowsany_exist) object Componentsregistry_object: >>hive Microsoftequals Defender"HKEY_LOCAL_MACHINE"; Antivirusname >>equals Scan"AllowArchiveScanning"; >>key equals "ScanSoftware\\Policies\\Microsoft\\Windows archiveDefender\\Policy filesManager" state isregistry_state: settype toequals "Enabledreg_dword"; orvalue "Notequals Configured".0" AND Procedure - Intune: UseComputer theConfiguration\Administrative Templates\Windows RegistryComponents\Microsoft EditorDefender toAntivirus\Scan\Scan navigatearchive files is set to the'1' registry_test following(check: keyall, existence: any_exist) HKLM\ object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowArchiveScanning"; key equals "Software\\Policies\\Microsoft\\Windows Defender\Scan\Policy Manager" Criteria state registry_state: Iftype theequals "reg_dword"; value equals "DisableArchiveScanning1" - isEnsure REG_DWORDthe =Group 0,Policy thisEquivalent is not aContradicting registry_test finding.(check: none satisfy, existence: any_exist) If object theregistry_object: valuehive doesequals not"HKEY_LOCAL_MACHINE"; exist,name thisequals is"DisableArchiveScanning"; notkey aequals finding."Software\\Policies\\Microsoft\\Windows Defender\\Scan" If state theregistry_state: valuetype isequals 1,"reg_dword"; thisvalue isequals a finding."1"

V-213448 in V2R10

Check text

ANDOR AND - ovalGroup Policy:mil.disa.stig.defenderantivirus:tst:24000 Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Scan\Scan removable drives is set to '0' registry_test (check: all, existence: at_least_one_existsany_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableRemovableDriveScanning"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value equals "0" Verify - Ensure the policyIntune valueEquivalent foris Computernot ConfigurationContradicting registry_test >>(check: Administrativenone Templatessatisfy, >>existence: Windowsany_exist) object Componentsregistry_object: >>hive equals "HKEY_LOCAL_MACHINE"; name equals "AllowFullScanRemovableDriveScanning"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Policy AntivirusManager" state >>registry_state: Scantype >>equals "reg_dword"; value equals "0" AND - Intune: Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Scan\Scan removable drives" is set to "Enabled".'1' registry_test Procedure(check: Useall, theexistence: Windowsany_exist) object Registryregistry_object: Editorhive toequals navigate"HKEY_LOCAL_MACHINE"; toname theequals following"AllowFullScanRemovableDriveScanning"; key: HKLM\equals "Software\\Policies\\Microsoft\\Windows Defender\Scan\Policy Manager" Criteria state registry_state: Iftype theequals "reg_dword"; value equals "DisableRemovableDriveScanning1" - isEnsure REG_DWORDthe =Group 0,Policy thisEquivalent is not aContradicting registry_test finding.(check: none satisfy, existence: any_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableRemovableDriveScanning"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value equals "1"

V-213449 in V2R10

Check text

AND - oval:mil.disa.stig.defenderantivirus:tst:25000 registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "ScheduleDay"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value less than or equal "7" Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Specify the day of the week to run a scheduled scan" is set to "Enabled" and anything other than "Never" is selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan Criteria: If the value "ScheduleDay" is REG_DWORD = 0x8, this is a finding. Values of 0x0 through 0x7 are acceptable and not a finding.

V-213450 in V2R10

Title

Microsoft Defender AV must be configured to turn on e-mail scanning.

Check text

ANDOR AND - oval:mil.disa.stig.defenderantivirus:tst:26000Group Policy - Configured properly registry_test (check: all, existence: ) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "DisableEmailScanning"; key case insensitive equals "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value equals "0" Verify - theIntune policy- valueConfigured forproperly Computeror Configurationabsent registry_test >>(check: Administrativeall, Templatesexistence: >>any_exist) object Windowsregistry_object: Componentshive >>equals Microsoft"HKEY_LOCAL_MACHINE"; Defendername Antiviruscase >>insensitive Scanequals >> "TurnAllowEmailScanning"; onkey e-mailcase scanninginsensitive equals "Software\\Policies\\Microsoft\\Windows isDefender\\Policy setManager" state toregistry_state: type equals "Enabledreg_dword".; value equals "1" AND Procedure - Intune - Configured properly registry_test (check: Useall, theexistence: Windows) object Registryregistry_object: Editorhive toequals navigate"HKEY_LOCAL_MACHINE"; toname thecase followinginsensitive equals "AllowEmailScanning"; key: HKLM\case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\Scan\Policy Manager" Criteria state registry_state: Iftype theequals "reg_dword"; value equals "DisableEmailScanning1" - isGroup REG_DWORDPolicy =- 0Configured properly or absent registry_test (check: all, thisexistence: isany_exist) object notregistry_object: ahive finding.equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "DisableEmailScanning"; key case insensitive equals "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Scan" state registry_state: type equals "reg_dword"; value equals "0"

Fix text

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on e-mailemail scanning" to "Enabled".

Discussion

This policy setting allows the configuration of e-mailemail scanning. When e-mailemail scanning is enabled, the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several e-mailemail formats are currently supported, for example: pst (Outlook), dbx mbx mime (Outlook Express), binhex (Mac). If this setting is enabled, e-mailemail scanning will be enabled. If this setting is disabled or not configured, e-mailemail scanning will be disabled.

V-213451 in V2R10

Check text

ANDOR AND - oval:mil.disa.stig.defenderantivirus:tst:30000Group Policy - Configured properly registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name case insensitive equals "5"; key case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Threats\\ThreatSeverityDefaultAction" state registry_state: type equals "reg_sz"; value less than or equal "3" Verify - theInutne policy- valueConfigured forproperly Computeror Configurationabsent registry_test >>(check: Administrativeall, Templatesexistence: >>any_exist) object Windowsregistry_object: Componentshive >>equals Microsoft"HKEY_LOCAL_MACHINE"; Defendername Antiviruscase >>insensitive Threatsequals >> "SpecifyThreatSeverityDefaultAction"; threatkey alertcase levelsinsensitive atequals which"Software\\Policies\\Microsoft\\Windows defaultDefender\\Policy actionManager" state shouldregistry_state: nottype beequals taken"reg_dword"; whenvalue detectedequals "1" state isregistry_state: settype toequals "Enabledreg_dword".; value equals "2" AND - Inutne - Configured properly Click registry_test the(check: “Show…”all, boxexistence: option) object andregistry_object: verifyhive theequals "ValueHKEY_LOCAL_MACHINE"; name" fieldcase containsinsensitive aequals value of "5ThreatSeverityDefaultAction"; andkey thecase insensitive equals "ValueSoftware\\Policies\\Microsoft\\Windows Defender\\Policy Manager" state field containsregistry_state: type equals "2reg_dword". A; value ofequals "31" state inregistry_state: thetype equals "Valuereg_dword"; fieldvalue isequals more"2" - restrictiveGroup andPolicy also- anConfigured acceptableproperly value.or absent Procedure registry_test (check: Useall, theexistence: Windowsany_exist) object Registryregistry_object: Editorhive toequals navigate"HKEY_LOCAL_MACHINE"; toname thecase followinginsensitive equals "5"; key: HKLM\case insensitive equals "Software\\Policies\\Microsoft\\Windows Defender\\Threats\\ThreatSeverityDefaultAction" Criteria state registry_state: Iftype theequals value "5reg_sz"; isvalue REG_SZless =than 2 (or 3),equal this is not a finding."3"

Fix text

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" to "Enabled". Select the "Show...…" option box and enter "5" in the "Value name" field and enter "2" in the "Value" field.

V-213455 in V2R10

Check text

OR AND - Verify Windows 10 is release id 1709 or newer registry_test (check: all, existence: all_exist) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "ReleaseId"; key equals "Software\\Microsoft\\Windows NT\\CurrentVersion" state registry_state: type equals "reg_sz"; value greater than or equal "1709" - Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites registry_test (check: all, existence: at_least_one_exists) object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "EnableNetworkProtection"; key equals "Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection" state registry_state: type equals "reg_dword"; value equals "1" This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Network Protection >> "Prevent users and apps from accessing dangerous websites" is set to "Enabled” and "Block" is selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection Criteria: If the value "EnableNetworkProtection" is REG_DWORD = 1, this is not a finding.

V-213463 in V2R10