diff --git a/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml b/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml new file mode 100644 index 0000000000..f20008fb44 --- /dev/null +++ b/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml @@ -0,0 +1,69 @@ + + + 1 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowRealtimeMonitoring + + + int + + 1 + + + + + + 2 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowCloudProtection + + + int + + 1 + + + + + + 3 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowBehaviorMonitoring + + + int + + 1 + + + + + + 4 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowScriptScanning + + + int + + 1 + + + + + + 5 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/SubmitSamplesConsent + + + int + + 1 + + diff --git a/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml new file mode 100644 index 0000000000..c9fbdddb7f --- /dev/null +++ b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml @@ -0,0 +1,66 @@ +- name: Windows - Windows Defender compliance check + query: | + WITH defender_service AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'IsServiceRunning' AND data = 1 THEN 1 END) > 0 THEN 1 + ELSE 0 + END as service_running + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender' + ), + defender_realtime AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableRealtimeMonitoring' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableRealtimeMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as realtime_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ), + defender_behavior AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableBehaviorMonitoring' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableBehaviorMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as behavior_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ), + defender_cloud AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'SpyNetReporting' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'SpyNetReporting' AND data > 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as cloud_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet' + ), + defender_script AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableScriptScanning' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableScriptScanning' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as script_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ) + SELECT + CASE + WHEN (SELECT service_running FROM defender_service) = 1 + AND (SELECT realtime_enabled FROM defender_realtime) = 1 + AND (SELECT behavior_enabled FROM defender_behavior) = 1 + AND (SELECT cloud_enabled FROM defender_cloud) = 1 + AND (SELECT script_enabled FROM defender_script) = 1 + THEN 1 + ELSE 0 + END as policy_compliance; + + critical: true + description: "Failing this policy indicates that Windows Defender service is not running, or one or more of the following features are disabled: real-time protection, behavior monitoring, cloud protection (MAPS), or script scanning. This could leave your device vulnerable to malware, spyware, and other security threats." + resolution: "Corrective actions include ensuring the Windows Defender service is running and that real-time protection, behavior monitoring, cloud protection, and script scanning are all enabled. Check that the MDM configuration profile has been applied successfully. If these actions are not successful, try rebooting before sending a message to #help-dogfooding in Slack." + platform: windows diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml index a6d88b7584..ec30a1c57b 100644 --- a/it-and-security/teams/workstations-canary.yml +++ b/it-and-security/teams/workstations-canary.yml @@ -138,6 +138,7 @@ controls: - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml - path: ../lib/windows/configuration-profiles/Disable Guest account.xml + - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml windows_updates: deadline_days: 7 grace_period_days: 2 @@ -164,6 +165,7 @@ controls: - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh - path: ../lib/macos/scripts/install-nudge.sh policies: + # macOS policies - path: ../lib/macos/policies/1password-emergency-kit-check.yml - path: ../lib/macos/policies/update-firefox.yml - path: ../lib/macos/policies/update-slack.yml @@ -178,11 +180,14 @@ policies: - path: ../lib/macos/policies/company-portal-installed.yml - path: ../lib/macos/policies/entra-conditional-access-check.yml - path: ../lib/macos/policies/install-nudge.yml + # Windows policies - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml - path: ../lib/windows/policies/all-windows-updates-installed.yml - path: ../lib/windows/policies/disk-encryption-check.yml - path: ../lib/windows/policies/1password-installed.yml - path: ../lib/windows/policies/update-1password.yml + - path: ../lib/windows/policies/windows-defender-compliance-check.yml + # Linux policies - path: ../lib/linux/policies/disk-encryption-check.yml - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml queries: diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml index 1b8b4ffe2b..4af3f66706 100644 --- a/it-and-security/teams/workstations.yml +++ b/it-and-security/teams/workstations.yml @@ -91,6 +91,7 @@ controls: - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml - path: ../lib/windows/configuration-profiles/Disable Guest account.xml + - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml windows_updates: deadline_days: 7 grace_period_days: 2 @@ -109,6 +110,7 @@ controls: - path: ../lib/macos/scripts/install-nudge.sh - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh policies: + # macOS policies - path: ../lib/macos/policies/1password-emergency-kit-check.yml - path: ../lib/macos/policies/update-firefox.yml - path: ../lib/macos/policies/latest-macos.yml @@ -118,13 +120,16 @@ policies: - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml - path: ../lib/macos/policies/disk-encryption-check.yml - path: ../lib/macos/policies/1password-installed.yml + - path: ../lib/macos/policies/install-macos-compatibility-extension.yml - path: ../lib/macos/policies/install-nudge.yml + # Windows policies - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml - path: ../lib/windows/policies/all-windows-updates-installed.yml - path: ../lib/windows/policies/disk-encryption-check.yml - path: ../lib/windows/policies/1password-installed.yml - path: ../lib/windows/policies/update-1password.yml - - path: ../lib/macos/policies/install-macos-compatibility-extension.yml + - path: ../lib/windows/policies/windows-defender-compliance-check.yml + # Linux policies - path: ../lib/linux/policies/disk-encryption-check.yml - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml queries: