Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Microsoft Defender AV must block abuse of exploited vulnerable signed drivers.
Description
Discussion Text
This policy setting prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications that have sufficient privileges to gain access to the kernel. Vulnerable signed drivers enable attackers to disable or circumvent security solutions, eventually leading to system compromise.
The Block abuse of exploited vulnerable signed drivers rule does not block a driver already existing on the system from being loaded.
The Block abuse of exploited vulnerable signed drivers rule does not block a driver already existing on the system from being loaded.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.