STIGQter: STIG Summary: Microsoft Windows Server 2025 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Windows Server 2025 system files must be monitored for unauthorized changes.

DISA Rule

SV-278006r1182237_rule

Vulnerability Number

V-278006

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

WN25-00-000220

Severity

CAT II

CCI(s)

• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.

Weight

10

Fix Recommendation

Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.

Check Contents

Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis.

If system files are not monitored for unauthorized changes, this is a finding.

An approved and properly configured solution will contain both a list of baselines that includes all system file locations and a file comparison task that is scheduled to run at least weekly.

Vulnerability Number

V-278006

Documentable

False

Rule Version

WN25-00-000220

Severity Override Guidance

Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis.

If system files are not monitored for unauthorized changes, this is a finding.

An approved and properly configured solution will contain both a list of baselines that includes all system file locations and a file comparison task that is scheduled to run at least weekly.

Check Content Reference

M

Target Key

5719