STIGQter STIGQter: STIG Summary: Symantec Endpoint Protection 12.1 Managed Client Antivirus Version: 1 Release: 4 Benchmark Date: 24 Jul 2015: The Symantec Endpoint Protection client weekly scheduled scan actions for handling security risks upon detection must be explicitly configured at the top, Security Risks, level and not be overridden by the Misleading Application sub-level.

DISA Rule

SV-55444r1_rule

Vulnerability Number

V-42716

Group Title

DTASEP062

Rule Version

DTASEP062

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Scheduled Scans -> Select Administrator-Defined Scans -> Double-click the Weekly Scan -> Select the Actions tab -> Under Actions -> Under Security Risks -> Select Misleading Application -> Ensure "Override actions configured for Security Risks" is NOT selected.

Check Contents

Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Scheduled Scans -> Select Administrator-Defined Scans -> Double-click the Weekly Scan -> Select the Actions tab -> Under Actions -> Under Security Risks -> Select Misleading Application -> Ensure "Override actions configured for Security Risks" is NOT selected.

Criteria: If "Override actions configured for Security Risks" is selected, this is a finding.

On the client machine use the Windows Registry Editor to navigate to the following key:
32 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded\TCID-14 is 0 or the value is not there, this is not a finding.

64 bit:
HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded\TCID-14 is 0 or the value is not there, this is not a finding.

Vulnerability Number

V-42716

Documentable

False

Rule Version

DTASEP062

Severity Override Guidance

Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Double-click the applied policy -> Under Windows Settings, Scheduled Scans -> Select Administrator-Defined Scans -> Double-click the Weekly Scan -> Select the Actions tab -> Under Actions -> Under Security Risks -> Select Misleading Application -> Ensure "Override actions configured for Security Risks" is NOT selected.

Criteria: If "Override actions configured for Security Risks" is selected, this is a finding.

On the client machine use the Windows Registry Editor to navigate to the following key:
32 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded\TCID-14 is 0 or the value is not there, this is not a finding.

64 bit:
HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded

Criteria: If the value of FirstAction is not 3, this is a finding.
If the value of FirstAction is 3, then check A. A must be compliant for the check to be not a finding.
A - If the value of OverrideDefaultActions within HKLM\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\Scheduler\{SID}\Custom Tasks\{Scan ID}\Expanded\TCID-14 is 0 or the value is not there, this is not a finding.

Check Content Reference

M

Target Key

2566

Comments