Detections
Analytics

1.129 WN11-CC-000085

Information

Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers.

GROUP ID: V-253372
RULE ID: SV-253372r991589

The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy is to enforce 'Good, unknown and bad but critical' (preventing 'bad'). By being launched first by the kernel, ELAM ( Early Launch Antimalware) is ensured to be launched before any third-party software, and is therefore able to detect malware in the boot process and prevent it from initializing.

Solution

Ensure that Early Launch Antimalware - Boot-Start Driver Initialization policy is set to enforce 'Good, unknown and bad but critical' (preventing 'bad').

To correct this, configure the policy value for

Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> 'Boot-Start Driver Initialization Policy'

to 'Enabled with 'Good, unknown and bad but critical' selected.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, Rule-ID|SV-253372r991589_rule, STIG-ID|WN11-CC-000085, Vuln-ID|V-253372

Plugin: Windows

Control ID: c7222590f37adc5b56263c65919d2a0ef4248f5b6d8bc3cd8fe055b0ec026f03