Detections
Analytics
DTOO124 - Scripted Window Security must be enforced.
Information
Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to:-Create browser windows appearing to be from the local operating system.
-Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input.
-Overlay parent windows with their own browser windows to hide important system information, choices or prompts.
Solution
Set the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security 'Scripted Window Security Restrictions' to 'Enabled' and place a check in the 'outlook.exe' check box.See Also
http://iasecontent.disa.mil/stigs/zip/U_MS_Outlook_2016_V1R2_STIG.zip
Item Details
Audit Name: DISA STIG Microsoft Outlook 2016 v1r2
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, CAT|II, CCI|CCI-001695, CSCv6|3.1, Rule-ID|SV-85741r1_rule, STIG-ID|DTOO124, Vuln-ID|V-71117
Plugin: Windows
Control ID: b9765a6324eb6d8be94c745d376674ca3e0b0eb1f45a4eea4e5a41cfa0248372