SV-213434r1134051: Microsoft Defender AV must join Microsoft MAPS. | Microsoft Defender Antivirus STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Microsoft Defender AV must join Microsoft MAPS.

Description

Discussion Text

This policy setting allows joining Microsoft MAPS. Microsoft MAPS is the online community that helps in choosing how to respond to potential threats. The community also helps stop the spread of new malicious software infections. You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new definitions and protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances personal information might unintentionally be sent to Microsoft. However Microsoft will not use this information to identify you or contact you. Possible options are: (0x0) Disabled (default) (0x1) Basic membership (0x2) Advanced membership Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. Advanced membership will send, in addition to basic information, more information to Microsoft about malicious software spyware and potentially unwanted software, including the location of the software file names, how the software operates, and how it has impacted your computer. If this setting is enabled, you will join Microsoft MAPS with the membership specified. If this setting is disabled or do not configured, you will not join Microsoft MAPS. In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001170SV-89847V-75167

References

DPMS Target Microsoft Defender Antivirus DISA DPMS Target Microsoft Defender Antivirus 3985

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windowsdefav:def:213434
# Microsoft Defender AV must join Microsoft MAPS.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# SpynetReporting == 1 or 2
# registry_object (registry_test)
function test_1 {
  return ((((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet').GetValueKind('SpynetReporting').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet' -Name 'SpynetReporting' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'SpynetReporting') -eq 1)) -or (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet').GetValueKind('SpynetReporting').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet' -Name 'SpynetReporting' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'SpynetReporting') -eq 2)))
}

if (test_1) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_defender_antivirus target this check assesses.

# OVAL Definition: oval:mil.disa.stig.windowsdefav:def:213434
$compliant = $true
if (Test-Path -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet") {
    $spynetReporting = Get-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Spynet" -Name "SpynetReporting" -ErrorAction SilentlyContinue
    if ($spynetReporting -and ($spynetReporting.SpynetReporting -eq 1 -or $spynetReporting.SpynetReporting -eq 2)) {
        $compliant = $false
    }
}
if ($compliant) { Write-Output "PASS"; exit 0 } else { Write-Output "FAIL"; exit 1 }

Remediation

This is applicable to unclassified systems. For other systems this is Not Applicable.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Join Microsoft MAPS" to "Enabled" and select "Basic MAPS" or "Advanced MAPS" from the drop-down box.