Home
Security Hardening
DISA STIG Windows Defender Antivirus V2R3

DISA STIG Windows Defender Antivirus V2R3

WNDF-AV-000014 – Windows Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.
Details This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This...
WNDF-AV-000015 – Windows Defender AV must be configured to not allow override of scanning for downloaded files and attachments.
Details This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This...
WNDF-AV-000016 – Windows Defender AV must be configured to not allow override of behavior monitoring.
Details This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set...
WNDF-AV-000032 – Windows Defender AV must be configured to block executable content from email client and webmail.
Details This rule blocks the following file types from being run or launched from an email seen in either Microsoft...
WNDF-AV-000033 – Windows Defender AV must be configured block Office applications from creating child processes.
Details Office apps, such as Word or Excel, will not be allowed to create child processes. This is a typical...
WNDF-AV-000034 – Windows Defender AV must be configured block Office applications from creating executable content.
Details This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable...
WNDF-AV-000035 – Windows Defender AV must be configured to block Office applications from injecting into other processes.
Details Office apps, such as Word, Excel, or PowerPoint, will not be able to inject code into other processes. This...
WNDF-AV-000036 – Windows Defender AV must be configured to impede JavaScript and VBScript to launch executables.
Details JavaScript and VBScript scripts can be used by malware to launch other malicious apps. This rule prevents these scripts...
WNDF-AV-000037 – Windows Defender AV must be configured to block execution of potentially obfuscated scripts.
Details Malware and other threats can attempt to obfuscate or hide their malicious code in some script files. This rule...
WNDF-AV-000038 – Windows Defender AV must be configured to block Win32 imports from macro code in Office.
Details This rule blocks potentially malicious behavior by not allowing macro code to execute routines in the Win 32 dynamic...

Prev Next

DISA STIG Windows Defender Antivirus V2R3

WNDF-AV-000014 – Windows Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.

WNDF-AV-000015 – Windows Defender AV must be configured to not allow override of scanning for downloaded files and attachments.

WNDF-AV-000016 – Windows Defender AV must be configured to not allow override of behavior monitoring.

WNDF-AV-000032 – Windows Defender AV must be configured to block executable content from email client and webmail.

WNDF-AV-000033 – Windows Defender AV must be configured block Office applications from creating child processes.

WNDF-AV-000034 – Windows Defender AV must be configured block Office applications from creating executable content.

WNDF-AV-000035 – Windows Defender AV must be configured to block Office applications from injecting into other processes.

WNDF-AV-000036 – Windows Defender AV must be configured to impede JavaScript and VBScript to launch executables.

WNDF-AV-000037 – Windows Defender AV must be configured to block execution of potentially obfuscated scripts.

WNDF-AV-000038 – Windows Defender AV must be configured to block Win32 imports from macro code in Office.