OpenControls Logo

STIG Viewer

STIGViewer Support

Microsoft Defender AV must set cloud protection level to High.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-278863WNDF-AV-000073SV-278863r1192833_ruleCCI-001170medium
Description
Cloud protection in Microsoft Defender Antivirus delivers accurate, real-time, and intelligent protection. Cloud protection should be enabled by default.
STIGDate
Microsoft Defender Antivirus Security Technical Implementation Guide2026-05-08

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-03.3Explicitly Allow / Deny Applications
0.50
END-10Mobile Code
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SC-18(1)Identify Unacceptable Code and Take Corrective Actions
1.00
SC-18(3)Prevent Downloading and Execution
1.00
SC-18(4)Prevent Automatic Execution
1.00
CCI1 mapping
CCI-001170
1.00

Details

Check Text (C-278863r1192833_chk)

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MpEngine >> Select cloud protection level is set to "Enabled". Verify the policy value for "Select cloud blocking level" is set to "High blocking level"; otherwise, this is a finding. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine Criteria: If the value "MpCloudBlockLevel" is REG_DWORD = 2, this is not a finding. If the value is other than 2, this is a finding.

Fix Text (F-83302r1190776_fix)

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MpEngine >> Select cloud protection level to "Enabled". Set policy value "Select cloud blocking level" to "High blocking level".