Microsoft Defender Antivirus STIG SCAP Benchmark

Version: 2

Updated: 21 Jan 2026

Findings: 67

Findings

xccdf_mil.disa.stig_group_V-213426 - Microsoft Defender AV must be configured to block the Potentially Unwanted Application (PUA) feature. (high)
xccdf_mil.disa.stig_group_V-213427 - Microsoft Defender AV must be configured to automatically take action on all detected tasks. (medium)
xccdf_mil.disa.stig_group_V-213428 - Microsoft Defender AV must be configured to run and scan for malware and other potentially unwanted software. (high)
xccdf_mil.disa.stig_group_V-213429 - Microsoft Defender AV must be configured to not exclude files for scanning. (medium)
xccdf_mil.disa.stig_group_V-213430 - Microsoft Defender AV must be configured to not exclude files opened by specified processes. (medium)
xccdf_mil.disa.stig_group_V-213431 - Microsoft Defender AV must be configured to enable the Automatic Exclusions feature. (medium)
xccdf_mil.disa.stig_group_V-213432 - Microsoft Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS. (medium)
xccdf_mil.disa.stig_group_V-213433 - Microsoft Defender AV must be configured to check in real time with MAPS before content is run or accessed. (medium)
xccdf_mil.disa.stig_group_V-213434 - Microsoft Defender AV must join Microsoft MAPS. (medium)
xccdf_mil.disa.stig_group_V-213435 - Microsoft Defender AV must be configured to only send safe samples for MAPS telemetry. (medium)
xccdf_mil.disa.stig_group_V-213436 - Microsoft Defender AV must be configured for protocol recognition for network protection. (medium)
xccdf_mil.disa.stig_group_V-213437 - Microsoft Defender AV must be configured to not allow local override of monitoring for file and program activity. (medium)
xccdf_mil.disa.stig_group_V-213438 - Microsoft Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity. (medium)
xccdf_mil.disa.stig_group_V-213439 - Microsoft Defender AV must be configured to not allow override of scanning for downloaded files and attachments. (medium)
xccdf_mil.disa.stig_group_V-213440 - Microsoft Defender AV must be configured to not allow override of behavior monitoring. (medium)
xccdf_mil.disa.stig_group_V-213441 - Microsoft Defender AV Group Policy settings must take priority over the local preference settings. (medium)
xccdf_mil.disa.stig_group_V-213442 - Microsoft Defender AV must monitor for incoming and outgoing files. (medium)
xccdf_mil.disa.stig_group_V-213443 - Microsoft Defender AV must be configured to monitor for file and program activity. (medium)
xccdf_mil.disa.stig_group_V-213444 - Microsoft Defender AV must be configured to scan all downloaded files and attachments. (medium)
xccdf_mil.disa.stig_group_V-213445 - Microsoft Defender AV must be configured to always enable real-time protection. (medium)
xccdf_mil.disa.stig_group_V-213446 - Microsoft Defender AV must be configured to enable behavior monitoring. (medium)
xccdf_mil.disa.stig_group_V-213447 - Microsoft Defender AV must be configured to process scanning when real-time protection is enabled. (medium)
xccdf_mil.disa.stig_group_V-213448 - Microsoft Defender AV must be configured to scan archive files. (medium)
xccdf_mil.disa.stig_group_V-213449 - Microsoft Defender AV must be configured to scan removable drives. (medium)
xccdf_mil.disa.stig_group_V-213450 - Microsoft Defender AV must be configured to perform a weekly scheduled scan. (medium)
xccdf_mil.disa.stig_group_V-213451 - Microsoft Defender AV must be configured to turn on e-mail scanning. (medium)
xccdf_mil.disa.stig_group_V-213452 - Microsoft Defender AV spyware definition age must not exceed 7 days. (high)
xccdf_mil.disa.stig_group_V-213453 - Microsoft Defender AV virus definition age must not exceed 7 days. (high)
xccdf_mil.disa.stig_group_V-213454 - Microsoft Defender AV must be configured to check for definition updates daily. (medium)
xccdf_mil.disa.stig_group_V-213455 - Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Severe. (medium)
xccdf_mil.disa.stig_group_V-213456 - Microsoft Defender AV must be configured to block executable content from email client and webmail. (medium)
xccdf_mil.disa.stig_group_V-213457 - Microsoft Defender AV must be configured block Office applications from creating child processes. (medium)
xccdf_mil.disa.stig_group_V-213458 - Microsoft Defender AV must be configured block Office applications from creating executable content. (medium)
xccdf_mil.disa.stig_group_V-213459 - Microsoft Defender AV must be configured to block Office applications from injecting into other processes. (medium)
xccdf_mil.disa.stig_group_V-213460 - Microsoft Defender AV must be configured to impede JavaScript and VBScript to launch executables. (medium)
xccdf_mil.disa.stig_group_V-213461 - Microsoft Defender AV must be configured to block execution of potentially obfuscated scripts. (medium)
xccdf_mil.disa.stig_group_V-213462 - Microsoft Defender AV must be configured to block Win32 imports from macro code in Office. (medium)
xccdf_mil.disa.stig_group_V-213463 - Microsoft Defender AV must be configured to prevent user and apps from accessing dangerous websites. (medium)
xccdf_mil.disa.stig_group_V-213464 - Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level High. (medium)
xccdf_mil.disa.stig_group_V-213465 - Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Medium. (medium)
xccdf_mil.disa.stig_group_V-213466 - Microsoft Defender AV must be configured for automatic remediation action to be taken for threat alert level Low. (medium)
xccdf_mil.disa.stig_group_V-278647 - Microsoft Defender AV must block Adobe Reader from creating child processes. (medium)
xccdf_mil.disa.stig_group_V-278648 - Microsoft Defender AV must block credential stealing from the Windows local security authority subsystem. (medium)
xccdf_mil.disa.stig_group_V-278649 - Microsoft Defender AV must block untrusted and unsigned processes that run from USB. (medium)
xccdf_mil.disa.stig_group_V-278650 - Microsoft Defender AV must use advanced protection against ransomware. (medium)
xccdf_mil.disa.stig_group_V-278651 - Microsoft Defender AV must block process creations originating from PSExec and WMI commands. (medium)
xccdf_mil.disa.stig_group_V-278652 - Microsoft Defender AV must block persistence through WMI event subscription. (medium)
xccdf_mil.disa.stig_group_V-278653 - Microsoft Defender AV must block executable files from running unless they meet a prevalence, age, or trusted list criterion. (medium)
xccdf_mil.disa.stig_group_V-278654 - Microsoft Defender AV must block Office communication application from creating child processes. (medium)
xccdf_mil.disa.stig_group_V-278655 - Microsoft Defender AV must block abuse of exploited vulnerable signed drivers. (medium)
xccdf_mil.disa.stig_group_V-278656 - Microsoft Defender AV must configure local administrator merge behavior for lists. (medium)
xccdf_mil.disa.stig_group_V-278658 - Microsoft Defender AV must control whether exclusions are visible to Local Admins. (medium)
xccdf_mil.disa.stig_group_V-278659 - Microsoft Defender AV must randomize scheduled task times. (medium)
xccdf_mil.disa.stig_group_V-278660 - Microsoft Defender AV must hide the Family options area. (medium)
xccdf_mil.disa.stig_group_V-278661 - Microsoft Defender AV must enable the file hash computation feature. (medium)
xccdf_mil.disa.stig_group_V-278662 - Microsoft Defender AV must enable extended cloud check. (medium)
xccdf_mil.disa.stig_group_V-278668 - Microsoft Defender AV must enable script scanning. (medium)
xccdf_mil.disa.stig_group_V-278669 - Microsoft Defender AV must enable real-time protection and Security Intelligence Updates during OOBE. (medium)
xccdf_mil.disa.stig_group_V-278672 - Microsoft Defender AV must enable network protection to be configured into block or audit mode on Windows Server. (medium)
xccdf_mil.disa.stig_group_V-278674 - Microsoft Defender AV must enable EDR in block mode. (medium)
xccdf_mil.disa.stig_group_V-278675 - Microsoft Defender AV must report Dynamic Signature dropped events. (medium)
xccdf_mil.disa.stig_group_V-278676 - Microsoft Defender AV must scan excluded files and directories during quick scans. (medium)
xccdf_mil.disa.stig_group_V-278677 - Microsoft Defender AV must convert warn verdict to block. (medium)
xccdf_mil.disa.stig_group_V-278678 - Microsoft Defender AV must enable asynchronous inspection. (medium)
xccdf_mil.disa.stig_group_V-278679 - Microsoft Defender AV must scan packed executables. (medium)
xccdf_mil.disa.stig_group_V-278680 - Microsoft Defender AV must enable heuristics. (medium)
xccdf_mil.disa.stig_group_V-278863 - Microsoft Defender AV must set cloud protection level to High. (medium)