From cf6343cbd4d02ce92df13339aca78cba2f5b43ff Mon Sep 17 00:00:00 2001 From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Date: Tue, 23 Sep 2025 14:02:44 -0500 Subject: [PATCH] Added new Windows Defender policy & configuration profile (#32956) - Added new Windows Defender policy that checks to make sure Windows Defender is running, antivirus is enabled, real-time protect is enabled, and data protection access is enabled. - Added additional formatting to policies section --- .../Windows Defender compliance settings.xml | 69 +++++++++++++++++++ .../windows-defender-compliance-check.yml | 66 ++++++++++++++++++ it-and-security/teams/workstations-canary.yml | 5 ++ it-and-security/teams/workstations.yml | 7 +- 4 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml create mode 100644 it-and-security/lib/windows/policies/windows-defender-compliance-check.yml diff --git a/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml b/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml new file mode 100644 index 0000000000..f20008fb44 --- /dev/null +++ b/it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml @@ -0,0 +1,69 @@ + + + 1 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowRealtimeMonitoring + + + int + + 1 + + + + + + 2 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowCloudProtection + + + int + + 1 + + + + + + 3 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowBehaviorMonitoring + + + int + + 1 + + + + + + 4 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowScriptScanning + + + int + + 1 + + + + + + 5 + + + ./Device/Vendor/MSFT/Policy/Config/Defender/SubmitSamplesConsent + + + int + + 1 + + diff --git a/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml new file mode 100644 index 0000000000..c9fbdddb7f --- /dev/null +++ b/it-and-security/lib/windows/policies/windows-defender-compliance-check.yml @@ -0,0 +1,66 @@ +- name: Windows - Windows Defender compliance check + query: | + WITH defender_service AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'IsServiceRunning' AND data = 1 THEN 1 END) > 0 THEN 1 + ELSE 0 + END as service_running + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender' + ), + defender_realtime AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableRealtimeMonitoring' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableRealtimeMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as realtime_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ), + defender_behavior AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableBehaviorMonitoring' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableBehaviorMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as behavior_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ), + defender_cloud AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'SpyNetReporting' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'SpyNetReporting' AND data > 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as cloud_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet' + ), + defender_script AS ( + SELECT + CASE + WHEN COUNT(CASE WHEN name = 'DisableScriptScanning' THEN 1 END) = 0 THEN 1 + WHEN MAX(CASE WHEN name = 'DisableScriptScanning' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1 + ELSE 0 + END as script_enabled + FROM registry + WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' + ) + SELECT + CASE + WHEN (SELECT service_running FROM defender_service) = 1 + AND (SELECT realtime_enabled FROM defender_realtime) = 1 + AND (SELECT behavior_enabled FROM defender_behavior) = 1 + AND (SELECT cloud_enabled FROM defender_cloud) = 1 + AND (SELECT script_enabled FROM defender_script) = 1 + THEN 1 + ELSE 0 + END as policy_compliance; + + critical: true + description: "Failing this policy indicates that Windows Defender service is not running, or one or more of the following features are disabled: real-time protection, behavior monitoring, cloud protection (MAPS), or script scanning. This could leave your device vulnerable to malware, spyware, and other security threats." + resolution: "Corrective actions include ensuring the Windows Defender service is running and that real-time protection, behavior monitoring, cloud protection, and script scanning are all enabled. Check that the MDM configuration profile has been applied successfully. If these actions are not successful, try rebooting before sending a message to #help-dogfooding in Slack." + platform: windows diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml index a6d88b7584..ec30a1c57b 100644 --- a/it-and-security/teams/workstations-canary.yml +++ b/it-and-security/teams/workstations-canary.yml @@ -138,6 +138,7 @@ controls: - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml - path: ../lib/windows/configuration-profiles/Disable Guest account.xml + - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml windows_updates: deadline_days: 7 grace_period_days: 2 @@ -164,6 +165,7 @@ controls: - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh - path: ../lib/macos/scripts/install-nudge.sh policies: + # macOS policies - path: ../lib/macos/policies/1password-emergency-kit-check.yml - path: ../lib/macos/policies/update-firefox.yml - path: ../lib/macos/policies/update-slack.yml @@ -178,11 +180,14 @@ policies: - path: ../lib/macos/policies/company-portal-installed.yml - path: ../lib/macos/policies/entra-conditional-access-check.yml - path: ../lib/macos/policies/install-nudge.yml + # Windows policies - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml - path: ../lib/windows/policies/all-windows-updates-installed.yml - path: ../lib/windows/policies/disk-encryption-check.yml - path: ../lib/windows/policies/1password-installed.yml - path: ../lib/windows/policies/update-1password.yml + - path: ../lib/windows/policies/windows-defender-compliance-check.yml + # Linux policies - path: ../lib/linux/policies/disk-encryption-check.yml - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml queries: diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml index 1b8b4ffe2b..4af3f66706 100644 --- a/it-and-security/teams/workstations.yml +++ b/it-and-security/teams/workstations.yml @@ -91,6 +91,7 @@ controls: - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml - path: ../lib/windows/configuration-profiles/Disable Guest account.xml + - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml windows_updates: deadline_days: 7 grace_period_days: 2 @@ -109,6 +110,7 @@ controls: - path: ../lib/macos/scripts/install-nudge.sh - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh policies: + # macOS policies - path: ../lib/macos/policies/1password-emergency-kit-check.yml - path: ../lib/macos/policies/update-firefox.yml - path: ../lib/macos/policies/latest-macos.yml @@ -118,13 +120,16 @@ policies: - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml - path: ../lib/macos/policies/disk-encryption-check.yml - path: ../lib/macos/policies/1password-installed.yml + - path: ../lib/macos/policies/install-macos-compatibility-extension.yml - path: ../lib/macos/policies/install-nudge.yml + # Windows policies - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml - path: ../lib/windows/policies/all-windows-updates-installed.yml - path: ../lib/windows/policies/disk-encryption-check.yml - path: ../lib/windows/policies/1password-installed.yml - path: ../lib/windows/policies/update-1password.yml - - path: ../lib/macos/policies/install-macos-compatibility-extension.yml + - path: ../lib/windows/policies/windows-defender-compliance-check.yml + # Linux policies - path: ../lib/linux/policies/disk-encryption-check.yml - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml queries: