STIGQter STIGQter: STIG Summary:

Microsoft Windows Defender Antivirus Security Technical Implementation Guide

Version: 2

Release: 2 Benchmark Date: 04 May 2021

CheckedNameTitle
SV-213426r569189_ruleWindows Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature.
SV-213427r569189_ruleWindows Defender AV must be configured to automatically take action on all detected tasks.
SV-213428r569189_ruleWindows Defender AV must be configured to run and scan for malware and other potentially unwanted software.
SV-213429r569189_ruleWindows Defender AV must be configured to not exclude files for scanning.
SV-213430r569189_ruleWindows Defender AV must be configured to not exclude files opened by specified processes.
SV-213431r569189_ruleWindows Defender AV must be configured to enable the Automatic Exclusions feature.
SV-213432r569189_ruleWindows Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS.
SV-213433r569189_ruleWindows Defender AV must be configured to check in real time with MAPS before content is run or accessed.
SV-213434r569189_ruleWindows Defender AV must be configured to join Microsoft MAPS.
SV-213435r569189_ruleWindows Defender AV must be configured to only send safe samples for MAPS telemetry.
SV-213436r569189_ruleWindows Defender AV must be configured for protocol recognition for network protection.
SV-213437r569189_ruleWindows Defender AV must be configured to not allow local override of monitoring for file and program activity.
SV-213438r569189_ruleWindows Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.
SV-213439r569189_ruleWindows Defender AV must be configured to not allow override of scanning for downloaded files and attachments.
SV-213440r569189_ruleWindows Defender AV must be configured to not allow override of behavior monitoring.
SV-213441r569189_ruleWindows Defender AV Group Policy settings must take priority over the local preference settings.
SV-213442r569189_ruleWindows Defender AV must monitor for incoming and outgoing files.
SV-213443r569189_ruleWindows Defender AV must be configured to monitor for file and program activity.
SV-213444r569189_ruleWindows Defender AV must be configured to scan all downloaded files and attachments.
SV-213445r569189_ruleWindows Defender AV must be configured to always enable real-time protection.
SV-213446r569189_ruleWindows Defender AV must be configured to enable behavior monitoring.
SV-213447r569189_ruleWindows Defender AV must be configured to process scanning when real-time protection is enabled.
SV-213448r569189_ruleWindows Defender AV must be configured to scan archive files.
SV-213449r569189_ruleWindows Defender AV must be configured to scan removable drives.
SV-213450r569189_ruleWindows Defender AV must be configured to perform a weekly scheduled scan.
SV-213451r569189_ruleWindows Defender AV must be configured to turn on e-mail scanning.
SV-213452r569189_ruleWindows Defender AV spyware definition age must not exceed 7 days.
SV-213453r569189_ruleWindows Defender AV virus definition age must not exceed 7 days.
SV-213454r569189_ruleWindows Defender AV must be configured to check for definition updates daily.
SV-213455r569189_ruleWindows Defender AV must be configured for automatic remediation action to be taken for threat alert level Severe.
SV-213456r569189_ruleWindows Defender AV must be configured to block executable content from email client and webmail.
SV-213457r569189_ruleWindows Defender AV must be configured block Office applications from creating child processes.
SV-213458r569189_ruleWindows Defender AV must be configured block Office applications from creating executable content.
SV-213459r569189_ruleWindows Defender AV must be configured to block Office applications from injecting into other processes.
SV-213460r569189_ruleWindows Defender AV must be configured to impede JavaScript and VBScript to launch executables.
SV-213461r569189_ruleWindows Defender AV must be configured to block execution of potentially obfuscated scripts.
SV-213462r569189_ruleWindows Defender AV must be configured to block Win32 imports from macro code in Office.
SV-213463r569189_ruleWindows Defender AV must be configured to prevent user and apps from accessing dangerous websites.
SV-213464r569189_ruleWindows Defender AV must be configured for automatic remediation action to be taken for threat alert level High.
SV-213465r569189_ruleWindows Defender AV must be configured for automatic remediation action to be taken for threat alert level Medium.
SV-213466r569189_ruleWindows Defender AV must be configured for automatic remediation action to be taken for threat alert level Low.