Update Windows Defender compliance check configuration (#40759)
This pull request updates the Windows Defender compliance check policy to improve detection accuracy and coverage. The main changes include more robust checks for Defender features, support for policy-based registry keys, and updates to documentation to reflect the expanded feature set. **Expanded compliance checks:** * The query now checks both standard and policy registry keys for all Defender features, ensuring that settings managed by group policy are detected. (`windows-defender-compliance-check.yml`, [it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70)) * Added a new check for anti-spyware protection (`antispyware_enabled`), making sure this critical feature is enabled. (`windows-defender-compliance-check.yml`, [it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70)) **Improved accuracy:** * All registry value comparisons now explicitly cast data to integers, reducing false negatives due to type mismatches. (`windows-defender-compliance-check.yml`, [it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70)) * The Defender service running check now directly verifies the service status instead of relying on registry values. (`windows-defender-compliance-check.yml`, [it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70)) **Documentation updates:** * The policy description and resolution steps have been updated to include anti-spyware protection and clarify the list of features checked. (`windows-defender-compliance-check.yml`, [it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL64-R81](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L64-R81))
This commit is contained in:
Allen Houchins
@@ -1,66 +1,82 @@
|
||||
- name: Windows - Windows Defender compliance check
|
||||
query: |
|
||||
WITH defender_service AS (
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'IsServiceRunning' AND data = 1 THEN 1 END) > 0 THEN 1
|
||||
SELECT
|
||||
CASE
|
||||
WHEN status = 'RUNNING' THEN 1
|
||||
ELSE 0
|
||||
END as service_running
|
||||
FROM registry
|
||||
FROM services
|
||||
WHERE name = 'WinDefend'
|
||||
),
|
||||
defender_antispyware AS (
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'DisableAntiSpyware' THEN 1 END) = 0 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableAntiSpyware' AND CAST(data AS INTEGER) = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
ELSE 0
|
||||
END as antispyware_enabled
|
||||
FROM registry
|
||||
WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender'
|
||||
OR key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender'
|
||||
),
|
||||
defender_realtime AS (
|
||||
SELECT
|
||||
CASE
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'DisableRealtimeMonitoring' THEN 1 END) = 0 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableRealtimeMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableRealtimeMonitoring' AND CAST(data AS INTEGER) = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
ELSE 0
|
||||
END as realtime_enabled
|
||||
FROM registry
|
||||
FROM registry
|
||||
WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
|
||||
OR key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection'
|
||||
),
|
||||
defender_behavior AS (
|
||||
SELECT
|
||||
CASE
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'DisableBehaviorMonitoring' THEN 1 END) = 0 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableBehaviorMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableBehaviorMonitoring' AND CAST(data AS INTEGER) = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
ELSE 0
|
||||
END as behavior_enabled
|
||||
FROM registry
|
||||
FROM registry
|
||||
WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
|
||||
OR key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection'
|
||||
),
|
||||
defender_cloud AS (
|
||||
SELECT
|
||||
CASE
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'SpyNetReporting' THEN 1 END) = 0 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'SpyNetReporting' AND data > 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'SpyNetReporting' AND CAST(data AS INTEGER) > 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
ELSE 0
|
||||
END as cloud_enabled
|
||||
FROM registry
|
||||
FROM registry
|
||||
WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet'
|
||||
OR key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet'
|
||||
),
|
||||
defender_script AS (
|
||||
SELECT
|
||||
CASE
|
||||
SELECT
|
||||
CASE
|
||||
WHEN COUNT(CASE WHEN name = 'DisableScriptScanning' THEN 1 END) = 0 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableScriptScanning' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
WHEN MAX(CASE WHEN name = 'DisableScriptScanning' AND CAST(data AS INTEGER) = 0 THEN 1 ELSE 0 END) = 1 THEN 1
|
||||
ELSE 0
|
||||
END as script_enabled
|
||||
FROM registry
|
||||
FROM registry
|
||||
WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
|
||||
OR key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection'
|
||||
)
|
||||
SELECT
|
||||
CASE
|
||||
WHEN (SELECT service_running FROM defender_service) = 1
|
||||
AND (SELECT realtime_enabled FROM defender_realtime) = 1
|
||||
AND (SELECT behavior_enabled FROM defender_behavior) = 1
|
||||
AND (SELECT cloud_enabled FROM defender_cloud) = 1
|
||||
AND (SELECT script_enabled FROM defender_script) = 1
|
||||
SELECT
|
||||
CASE
|
||||
WHEN (SELECT service_running FROM defender_service) = 1
|
||||
AND (SELECT antispyware_enabled FROM defender_antispyware) = 1
|
||||
AND (SELECT realtime_enabled FROM defender_realtime) = 1
|
||||
AND (SELECT behavior_enabled FROM defender_behavior) = 1
|
||||
AND (SELECT cloud_enabled FROM defender_cloud) = 1
|
||||
AND (SELECT script_enabled FROM defender_script) = 1
|
||||
THEN 1
|
||||
ELSE 0
|
||||
END as policy_compliance;
|
||||
|
||||
critical: true
|
||||
description: "Failing this policy indicates that Windows Defender service is not running, or one or more of the following features are disabled: real-time protection, behavior monitoring, cloud protection (MAPS), or script scanning. This could leave your device vulnerable to malware, spyware, and other security threats."
|
||||
resolution: "Corrective actions include ensuring the Windows Defender service is running and that real-time protection, behavior monitoring, cloud protection, and script scanning are all enabled. Check that the MDM configuration profile has been applied successfully. If these actions are not successful, try rebooting before sending a message to #help-dogfooding in Slack."
|
||||
description: "Failing this policy indicates that the Windows Defender service is not running, or one or more of the following features are disabled: anti-spyware protection, real-time protection, behavior monitoring, cloud protection (MAPS), or script scanning. This could leave your device vulnerable to malware, spyware, and other security threats."
|
||||
resolution: "Corrective actions include ensuring the Windows Defender service is running and that anti-spyware protection, real-time protection, behavior monitoring, cloud protection, and script scanning are all enabled. Check that the MDM configuration profile has been applied successfully. If these actions are not successful, try rebooting before sending a message to #help-dogfooding in Slack."
|
||||
platform: windows
|
||||
|
||||
Reference in New Issue
Block a user