OpenControls Logo

STIG Viewer

STIGViewer Support

Microsoft Defender AV must block credential stealing from the Windows local security authority subsystem.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-278648WNDF-AV-000044SV-278648r1192809_ruleCCI-001170medium
Description
This policy setting helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).
STIGDate
Microsoft Defender Antivirus Security Technical Implementation Guide2026-05-08

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-03.3Explicitly Allow / Deny Applications
0.50
END-10Mobile Code
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SC-18(1)Identify Unacceptable Code and Take Corrective Actions
1.00
SC-18(3)Prevent Downloading and Execution
1.00
SC-18(4)Prevent Automatic Execution
1.00
CCI1 mapping
CCI-001170
1.00

Details

Check Text (C-278648r1192809_chk)

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Attack Surface Reduction >> Configure Attack Surface Reduction rules is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules Criteria: If the value "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" is REG_SZ = 1, this is not a finding. If the value is other than 1, this is a finding.

Fix Text (F-83087r1190727_fix)

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Microsoft Defender Exploit Guard >> Attack Surface Reduction >> Configure Attack Surface Reduction rules to "Enabled". Under the policy option "Set the state for each ASR rule:", then click "Show". Enter GUID "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" in the "Value Name" column. Enter "1" in the "Value" column.