Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Microsoft Defender AV must audit process creations originating from PSExec and WMI commands.
Description
Discussion Text
This policy setting blocks processes created through PsExec and WMI from running. Both PsExec and WMI can remotely execute code. There is a risk of malware abusing functionality of PsExec and WMI for command and control purposes, or to spread an infection throughout an organization's network.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.