Microsoft Defender AV must be configured to check in real time with MAPS before content is run or accessed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213433	WNDF-AV-000009	SV-213433r823038_rule		Medium

Description
This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. Enabled - The Block at First Sight setting is turned on. Disabled - The Block at First Sight setting is turned off. This feature requires these Group Policy settings to be set as follows: MAPS >> The "Join Microsoft MAPS" must be enabled or the "Block at First Sight" feature will not function. MAPS >> The "Send file samples when further analysis is required" should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. Real-time Protection >> The "Scan all downloaded files and attachments" policy must be enabled or the "Block at First Sight" feature will not function. Real-time Protection >> Do not enable the "Turn off real-time protection" policy or the "Block at First Sight" feature will not function.

Description

This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. Enabled - The Block at First Sight setting is turned on. Disabled - The Block at First Sight setting is turned off. This feature requires these Group Policy settings to be set as follows: MAPS >> The "Join Microsoft MAPS" must be enabled or the "Block at First Sight" feature will not function. MAPS >> The "Send file samples when further analysis is required" should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function. Real-time Protection >> The "Scan all downloaded files and attachments" policy must be enabled or the "Block at First Sight" feature will not function. Real-time Protection >> Do not enable the "Turn off real-time protection" policy or the "Block at First Sight" feature will not function.

STIG	Date
Microsoft Defender Antivirus Security Technical Implementation Guide	2022-04-08

Details

Check Text ( C-14658r820146_chk )
This is applicable to unclassified systems. For other systems this is NA. Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Configure the 'Block at First Sight' feature" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a finding.

Check Text ( C-14658r820146_chk )

This is applicable to unclassified systems. For other systems this is NA.

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Configure the 'Block at First Sight' feature" is set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender\Spynet

Criteria: If the value "DisableBlockAtFirstSeen" is REG_DWORD = 0, this is not a finding.

Fix Text (F-14656r823037_fix)
This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Configure the 'Block at First Sight' feature" to "Enabled".