STIGQter: STIG Summary: Microsoft DotNet Framework 4.0 Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Event tracing for Windows (ETW) for Common Language Runtime events must be enabled.

DISA Rule

SV-225235r615940_rule

Vulnerability Number

V-225235

Group Title

SRG-APP-000095

Rule Version

APPNET0067

Severity

CAT II

CCI(s)

• CCI-000130 - The information system generates audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Open Windows explorer and search for all .NET config files including application config files (*.exe.config).

Examine the configuration settings for
<etwEnable enabled="false" />.

Enable ETW Tracing by setting the etwEnable flag to "true" or obtain documented IAO approvals.

Check Contents

Open Windows explorer and search for all .NET config files including application config files (*.exe.config)

NOTE:
Beginning with Windows Vista and Windows Server 2008, ETW Tracing is enabled by default and the "etwEnable" setting is not required in order for Event Tracing to be enabled. An etwEnable setting of "true" IS required in earlier versions of Windows as ETW is disabled by default.

Examine the configuration settings for
<etwEnable enabled="false" />.

If the "etwEnable" element is set to "true", this is not a finding.

If the "etwEnable" element is set to "false" and documented approvals by the IAO are not provided, this is a finding.

Vulnerability Number

V-225235

Documentable

False

Rule Version

APPNET0067

Severity Override Guidance

Open Windows explorer and search for all .NET config files including application config files (*.exe.config)

NOTE:
Beginning with Windows Vista and Windows Server 2008, ETW Tracing is enabled by default and the "etwEnable" setting is not required in order for Event Tracing to be enabled. An etwEnable setting of "true" IS required in earlier versions of Windows as ETW is disabled by default.

Examine the configuration settings for
<etwEnable enabled="false" />.

If the "etwEnable" element is set to "true", this is not a finding.

If the "etwEnable" element is set to "false" and documented approvals by the IAO are not provided, this is a finding.

Check Content Reference

M

Target Key

4213

Comments