WNDF-AV-000050 - Microsoft Defender AV must block Office communication application from creating child processes.

Information

This policy setting prevents Outlook from creating child processes while still allowing legitimate Outlook functions. This rule protects against social engineering attacks and prevents exploiting code from abusing vulnerabilities in Outlook. It also protects against Outlook rules and forms exploits that attackers can use when a user's credentials are compromised.

Solution

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Attack Surface Reduction >> Configure Attack Surface Reduction rules to 'Enabled'.

Under the policy option 'Set the state for each ASR rule:', then click 'Show'.

Enter GUID '26190899-1602-49e8-8b27-eb1d0a1ce869' in the 'Value Name' column.

Enter '1' in the 'Value' column.

Item Details

Audit Name: DISA Microsoft Defender Antivirus STIG v2r9

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Windows

Control ID: f3d237557c1d9f62e8d07daee02c44432d4e577efb6594dbb7891eff6c0a86ee

Detections

Analytics

WNDF-AV-000050 - Microsoft Defender AV must block Office communication application from creating child processes.

Information

Solution

See Also

Item Details