Detections
Analytics

WNDF-AV-000022 - Microsoft Defender AV must be configured to enable behavior monitoring.

Information

This policy setting allows configuration of behavior monitoring. If this setting is enabled or not configured, behavior monitoring will be enabled. If this setting is disabled, behavior monitoring will be disabled.

Solution

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> Real-time Protection >> 'Turn on behavior monitoring' to 'Enabled ' or 'Not Configured'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Defender_Antivirus_V2R10_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(4), CAT|II, CCI|CCI-001170, Rule-ID|SV-213446r1260210_rule, STIG-ID|WNDF-AV-000022, STIG-Legacy|SV-89909, STIG-Legacy|V-75229, Vuln-ID|V-213446

Plugin: Windows

Control ID: 9c0f1877bb61f2f751ba372d5a1d4acca38ac47dbf800e871a34be179cba3a28