Detections
Analytics

1.32.1 Ensure 'Configure Microsoft Edge Scareware blocker protection' is set to 'Enabled'

Information

This policy setting controls whether Microsoft Edge enables Scareware blocker, an AI-powered feature for protecting users from potential tech scams.

The recommended state for this setting is: Enabled.

Note: When this policy is enabled, the policies ScarewareBlockerBlocksDetectedSitesEnabled, ScarewareBlockerSendDetectedSitesToSmartScreenEnabled, and ScarewareBlockerAllowListDomains are used to configure the behavior of the Scareware blocker feature. Scareware blocker is enabled by default only on devices with more than 2GB of RAM and at least five processor cores.

Scareware attacks use full-screen alerts, fake virus warnings, and urgent messaging to trick users into calling fraudulent support numbers or downloading malicious software. Without Scareware blocker, users have no browser-level protection against these social engineering attacks, which can result in credential theft, unauthorized remote access, or financial loss.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Scareware Blocker settings\Configure Microsoft Edge Scareware blocker protection

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Impact:

Microsoft Edge downloads a machine learning model file from Microsoft to the device to support Scareware blocker. The feature uses local AI processing and does not send browsing data to a cloud service for detection.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CSCv7|8.3

Plugin: Windows

Control ID: fdf08464e81117f0516e21f5ddfdf95fe221b6646a76b87dca3010bc44976f5c