WNDF-AV-000048 - Microsoft Defender AV must audit persistence through WMI event subscription.

Information

This policy setting prevents malware from abusing WMI to attain persistence on a device.

Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.

Solution

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Attack Surface Reduction >> Configure Attack Surface Reduction rules to 'Enabled'.

Under the policy option 'Set the state for each ASR rule:', then click 'Show'.

Enter GUID 'e6db77e5-3df2-4cf1-b95a-636979351e5b' in the 'Value Name' column.

Enter '2' in the 'Value' column.

Item Details

Audit Name: DISA Microsoft Defender Antivirus STIG v2r9

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Windows

Control ID: d40fc6066158efa2b6e28f494d22af6b75cc24b8f5fdf7e5e198caabb3357591

Detections

Analytics

WNDF-AV-000048 - Microsoft Defender AV must audit persistence through WMI event subscription.

Information

Solution

See Also

Item Details