Microsoft Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-213426 | WNDF-AV-000001 | SV-213426r823024_rule | CCI-001243 | high |
| Description | ||||
| After enabling this feature, PUA protection blocking takes effect on endpoint clients after the next signature update or computer restart. Signature updates take place daily under typical circumstances. PUA will be blocked and automatically quarantined. | ||||
| STIG | Date | |||
| Microsoft Defender Antivirus Security Technical Implementation Guide | 2022-04-08 | |||
Related Frameworks
7 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
SI-3
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1715 mappings
3.14.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.3
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.4
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.14.5
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-001243
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-213426r823024_chk)
Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Configure detection for potentially unwanted applications" is set to "Enabled" and "Block".
Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender
If the value "PUAProtection" does not exist, this is a finding.
If the value "PUAProtection" is REG_DWORD = 1, this is not a finding.
Fix Text (F-14649r823023_fix)
Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> "Configure Detection for Potentially Unwanted Applications" to "Enabled" and "Block".