Detections
Analytics
WNDF-AV-000033 - Windows Defender AV must be configured block Office applications from creating child processes.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Office apps, such as Word or Excel, will not be allowed to create child processes.This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
Solution
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Antivirus -> Windows Defender Exploit Guard -> Attack Surface Reduction -> 'Configure Attack Surface Reduction rules' to 'Enabled'. Click 'Show...'. Set the Value name to 'D4F940AB-401B-4EFC-AADC-AD5F3C50688A' and the Value to '1'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Defender_Antivirus_V1R9_STIG.zip
Item Details
Audit Name: DISA STIG Windows Defender Antivirus v1r9
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-3, CAT|II, CCI|CCI-001170, Rule-ID|SV-92663r1_rule, STIG-ID|WNDF-AV-000033, Vuln-ID|V-77967
Plugin: Windows
Control ID: 50c3cfcdc565d1d82420ae98eeb52347f3c7d675ef8ac418ef41fda2953c3d81