Title

(U) The Trellix ENS Threat Prevention On-Demand Scan must be configured to scan all fixed or local disks, running processes, and memory for rootkits. (Cat II impact)

Discussion

(U) Antivirus software is the most commonly used technical control for malware threat mitigation. Antivirus software on hosts should be configured to scan all hard drives regularly to identify any file system infections and to scan any removable media, if applicable, before media is inserted into the system. Not scheduling a regular scan of a system's hard drives and/or not configuring the scan to scan all files and running processes introduces a higher risk of threats going undetected.

Check Content

(U) In the system tray, right-click the Trellix icon and select "Trellix Endpoint Security". Click the drop-down in the upper right corner of the "Trellix Endpoint Security" window and select "Settings". (This may require Administrator logon.) In the "Settings" pop-up, click "Threat Prevention" on the left side. Click the "Show Advanced" button. Under "On-Demand Scan", select the "Full Scan" tab. Verify "All local drives" and/or "All fixed drives" is listed, and verify "Running processes" and "Memory for rootkits" are listed in the "Locations" table. If "All local drives" and/or "All fixed drives" and "Running processes" and "Memory for rootkits" are not selected, this is a finding.

Fix Text

(U) In the system tray, right-click the Trellix icon and select "Trellix Endpoint Security". Click the drop-down in the upper right corner of the "Trellix Endpoint Security" window and select "Settings". (This may require Administrator logon.) In the "Settings" pop-up, click "Threat Prevention" on the left side. Click the "Show Advanced" button. Under "On-Demand Scan", select the "Full Scan" tab. Add "All local drives" or "All fixed drives", "Running processes", and "Memory for rootkits" to the "Locations" table.

Additional Identifiers

Rule ID: SV-252813r961191_rule

Vulnerability ID: V-252813

Group Title: SRG-APP-000277

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.