STIGQter: STIG Summary: Microsoft Defender Antivirus Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Microsoft Defender AV spyware definition age must not exceed 7 days.

DISA Rule

SV-213452r1192806_rule

Vulnerability Number

V-213452

Group Title

SRG-APP-000276

Rule Version

WNDF-AV-000028

Severity

CAT I

CCI(s)

• CCI-004964 - Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy.

Weight

10

Fix Recommendation

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender Antivirus >> Signature Updates >> "Define the number of days before spyware definitions are considered out of date" to "Enabled" and select "7" or less in the drop-down box.

Do not select a value of 0. This disables the option.

Check Contents

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Security Intelligence Updates >> "Define the number of days before spyware security intelligence considered out of date" is set to "Enabled" and "7" or less is selected in the drop-down box (excluding "0", which is unacceptable).

If third-party antispyware is installed and up to date, the Windows Defender AV spyware age requirement will be NA.

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates

Criteria: If the value "ASSignatureDue" is REG_DWORD = 7, this is not a finding.

A value of 1 - 6 is also acceptable and not a finding.

A value of 0 is a finding.

A value higher than 7 is a finding.

Vulnerability Number

V-213452

Documentable

False

Rule Version

WNDF-AV-000028

Severity Override Guidance

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Security Intelligence Updates >> "Define the number of days before spyware security intelligence considered out of date" is set to "Enabled" and "7" or less is selected in the drop-down box (excluding "0", which is unacceptable).

If third-party antispyware is installed and up to date, the Windows Defender AV spyware age requirement will be NA.

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates

Criteria: If the value "ASSignatureDue" is REG_DWORD = 7, this is not a finding.

A value of 1 - 6 is also acceptable and not a finding.

A value of 0 is a finding.

A value higher than 7 is a finding.

Check Content Reference

M

Target Key

3985