[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

248268

 
 

909

 
 

195051

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-38376-0

Platform: cpe:/o:microsoft:windows_server_2012::r2Date: (C)2015-10-08   (M)2023-07-04



Process Exclusions This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: 'c:windowsapp.exe'. The value is not used and it is recommended that this be set to 0. If you enable this setting, scheduled and real-time scanning for any file opened by a specified process will be excluded. If you disable or do not configure this setting, scheduled and real-time scanning for files will happen for all processes.


Parameter:

[enable/disable]


Technical Mechanism:

(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows DefenderExclusions!Process Exclusions (2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows DefenderExclusions!Exclusions_Processes

CCSS Severity:CCSS Metrics:
CCSS Score : 6.3Attack Vector: LOCAL
Exploit Score: 0.8Attack Complexity: LOW
Impact Score: 5.5Privileges Required: HIGH
Severity: MEDIUMUser Interaction: NONE
Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:LScope: UNCHANGED
 Confidentiality: HIGH
 Integrity: HIGH
 Availability: LOW
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:28595


OVAL    1
oval:org.secpod.oval:def:28595
XCCDF    1
xccdf_org.secpod_benchmark_general_Windows_2012_R2

© SecPod Technologies