What changed in Microsoft Defender Antivirus STIG V2R10V2R10 changes

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block". Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender If the value "PUAProtection" does not exist, this is a finding. If the value "PUAProtection" is "REG_DWORD = 1", this is not a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "PUAProtection" is "REG_DWORD = 1", this is not a finding.

V-213426 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Configure monitoring for incoming and outgoing file and program activity" is set to "Enabled" with a policy option value of "bi-directional (full on-access)". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Real-Time Protection CriteriaIf the value "RealtimeScanDirection" is"REG_DWORD = 0", this is not a finding. If the value is "1" or "2", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "RealtimeScanDirection" is "REG_DWORD = 0", this is not a finding. If the value is "1" or "2", this is a finding.

V-213442 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Monitor file and program activity on your computer to be scanned" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: "HKLM1Software1Policies1Microsoft1Windows Defender1Real-Time Protection Criteria: If the value "DisableOnAccessProtection" is "REG_DWORD = 0", this is not a finding. If the value does not exist, this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowOnAccessProtection" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213443 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Scan all downloaded files and attachments" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Real-Time Protection Criteria: If the value "DisableIOAVProtection" is "REG_DWORD = 0", this is not a finding. If the value does not exist, this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowIOAVProtection" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213444 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Turn off real-time protection" is set to "Disabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Real-Time Protection Criteria: If the value "DisableRealtimeMonitoring" is "REG_DWORD = 0", this is not a finding. If the value does not exist, this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowRealtimeMonitoring" is "REG_DWORD = 1", this is not a finding. If the value is "1", this is a finding.

V-213445 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Real-time Protection >> "Turn on behavior monitoring" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Real-Time Protection Criteria: If the value "DisableBehaviorMonitoring" is "REG_DWORD = 0", this is not a finding. If the value does not exist, this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowBehaviorMonitoring" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213446 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Scan archive files" is set to "Enabled" or "Not Configured". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Scan Criteria: If the value "DisableArchiveScanning" is "REG_DWORD = 0", this is not a finding. If the value does not exist, this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowArchiveScanning" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213448 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Scan removable drives" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Scan Criteria: If the value "DisableRemovableDriveScanning" is "REG_DWORD = 0", this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowFullScanRemovableDriveScanning" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213449 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Specify the day of the week to run a scheduled scan" is set to "Enabled" and anything other than "Never" is selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Scan Criteria: If the value "ScheduleDay" is "REG_DWORD = 0x8", this is a finding. Values of "0x0" through "0x7" are acceptable and not a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "ScheduleScanDay" is "REG_DWORD = 0x8", this is a finding. Values of "0x0" through "0x7" are acceptable and not a finding.

V-213450 in V2R10

Title

Microsoft Defender AV must be configured to turn on e-mail scanning.

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on e-mailemail scanning" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Scan Criteria: If the value "DisableEmailScanning" is "REG_DWORD = 0", this is not a finding. If the value is "1", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "AllowEmailScanning" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

Fix text

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on e-mailemail scanning" to "Enabled".

Discussion

This policy setting allows the configuration of e-mailemail scanning. When e-mailemail scanning is enabled, the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several e-mailemail formats are currently supported, for example: pst (Outlook), dbx mbx mime (Outlook Express), binhex (Mac). If this setting is enabled, e-mailemail scanning will be enabled. If this setting is disabled or not configured, e-mailemail scanning will be disabled.

V-213451 in V2R10

Check text

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Threats >> "Specify threat alert levels at which default action should not be taken when detected" is set to "Enabled". Click the "Show…" box option and verify the "Value name" field contains a value of "5" and the "Value" field contains "2". A value of "3" in the "Value" field is more restrictive and also an acceptable value. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Threats1ThreatSeverityDefaultAction Criteria: If the value "5" is "REG_SZ = 2 (or 3)", this is not a finding. If the value is "6", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "ThreatSeverityDefaultAction" is "REG_DWORD = 1 (or 2)", this is not a finding. If the value is "0", this is a finding.

V-213455 in V2R10

Check text

This setting is applicable starting with v1709 of Windows 10, it is NA for prior versions. Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Network Protection >> "Prevent users and apps from accessing dangerous websites" is set to "Enabled" and "Block" is selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM1Software1Policies1Microsoft1Windows Defender1Windows Defender Exploit Guard1Network Protection CriteriaIf the value "EnableNetworkProtection" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding. Alternate Check (if Microsoft Intune applied this setting): Navigate to "HKLM1Software1Policies1Microsoft1Windows Defender1Policy Manager". If the value "EnableNetworkProtection" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

V-213463 in V2R10