WNDF-AV-000043 - Microsoft Defender AV must block Adobe Reader from creating child processes.

Information

This policy setting prevents Adobe Reader from launching other processes, which can help mitigate security risks associated with malicious PDF files.

Solution

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Attack Surface Reduction >> Configure Attack Surface Reduction rules to 'Enabled'.

Under the policy option 'Set the state for each ASR rule:', then click 'Show'.

Enter GUID '7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c' in the 'Value Name' column.

Enter '1' in the 'Value' column.

Item Details

Audit Name: DISA Microsoft Defender Antivirus STIG v2r9

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Windows

Control ID: 32a0b274ee549abfddb56b3e3e5e14fab8daa8f72ca239b52ed96a8c15ad84fe

Detections

Analytics

WNDF-AV-000043 - Microsoft Defender AV must block Adobe Reader from creating child processes.

Information

Solution

See Also

Item Details