Detections
Analytics
WN11-CC-000080 - Virtualization-based protection of code integrity must be enabled.
Information
Virtualization-based protection of code integrity enforces kernel mode memory protections as well as protecting Code Integrity validation paths. This isolates the processes from the rest of the operating system and can only be accessed by privileged system software.Solution
Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> 'Turn On virtualization-based Security' to 'Enabled' with 'Enabled with UEFI lock' or 'Enabled without lock' selected for 'virtualization-based Protection of Code Integrity:'.'Enabled with UEFI lock' is preferred as more secure; however, it cannot be turned off remotely through a group policy change if there is an issue.
'Enabled without lock' will allow this to be turned off remotely while testing for issues.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r9
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-253371r1210291_rule, STIG-ID|WN11-CC-000080, Vuln-ID|V-253371
Plugin: Windows
Control ID: 798c3b345c191486a6094de748e20349ae05066951ee2937814f63e5915f3d68