Detections
Analytics
WNDF-AV-000070 - Microsoft Defender AV must enable EDR in block mode.
Information
EDR in block mode allows Microsoft Defender Antivirus to take actions on post-breach, behavioral EDR detections. EDR in block mode is integrated with threat and vulnerability management capabilities.Solution
Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Features >> Enable EDR in block mode to 'Enabled'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Defender_Antivirus_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Defender Antivirus STIG v2r9
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-18(4), CAT|II, CCI|CCI-001170, Rule-ID|SV-278674r1192826_rule, STIG-ID|WNDF-AV-000070, Vuln-ID|V-278674
Plugin: Windows
Control ID: f366ec48ce4e032a2656153b2417c553bbb6d4ab89ab2285c0275ab450349c1a