INTUNE-008: Windows Defender/Antivirus policy audit
- Plataforma
- Entra ID / M365
- Categoría
- Intune / Endpoint Management
- Severidad
- Critical
- Pilar de Zero Trust
- Devices (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Windows Defender Antivirus is the primary endpoint protection agent on Windows devices and must be properly configured to provide real-time protection, cloud-delivered protection, and sample submission. Disabled or weakened antivirus settings leave devices vulnerable to malware infections that can lead to data theft, ransomware, and lateral movement. Attackers frequently attempt to tamper with or disable antivirus as a first step in an attack chain.
Valor recomendado
Real-time protection enabled, cloud-delivered protection enabled, automatic sample submission enabled, tamper protection enabled
Remediación
Deploy an Intune antivirus policy that enforces real-time protection, cloud-delivered protection, automatic sample submission, and tamper protection on all managed Windows devices. Verify that PUA (Potentially Unwanted Application) protection is enabled and that scheduled scans are configured for at least weekly full scans. Monitor the Defender antivirus agent status across the fleet and investigate any devices reporting disabled protection or outdated definitions.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-3
- MITRE ATT&CK
- T1562.001