Detections
Analytics

18.10.43.11.1.2.1 (L2) Ensure 'Configure how aggressively Remote Encryption Protection blocks threats' is set to 'Enabled: Medium' or higher

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting configures how aggressively Remote Encryption Prevention Protection blocks malicious IP addresses.

The recommended state for this setting is: Enabled: Medium or higher. Configuring this setting to High also conforms to the benchmark.

This feature can help reduce the likelihood of users visiting malicious websites.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Medium or higher:

Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Remediation\Behavioral Network Blocks\Remote Encryption Protection\Configure how aggressively Remote Encryption Protection blocks threats

Note: This Group Policy path is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 11 Release 24H2 Administrative Templates (or newer).

Impact:

Legitimate websites could be blocked by Remote Encryption Prevention Protection. When set to Medium, blocks will occur when the confidence level is above 99%. When set to High, blocks will occur when confidence level is above 90%.

See Also

https://workbench.cisecurity.org/benchmarks/22944

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8.1

Plugin: Windows

Control ID: adc3bb5c80a850f6560724d56623603a40d9282368c8bded0ffff870d54ebb28