Title

(U) The ENS Generic Privilege Escalation Prevention must be enabled. (Cat II impact)

Discussion

(U) For antivirus software to be effective it must be running at all times beginning from the point of the system's initial startup. Otherwise the risk is greater for viruses, trojans, and other malware infecting the system during that startup phase.

Check Content

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog and then select “Endpoint Protection Threat Prevention” from the Product list. From the Category list, select “Exploit Prevention”. Select each configured “Exploit Prevention” policy. Verify the Threat Prevention >> Exploit Prevention >> “Enable Generic Privilege Escalation Prevention” check box is selected. If the Threat Prevention >> Exploit Prevention >> “Enable Generic Privilege Escalation Prevention” check box is not selected, this is a finding.

Fix Text

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog and then select "Endpoint Protection Threat Prevention" from the Product list. From the Category list, select "Exploit Prevention". Select each configured "Exploit Prevention" policy. Select the Threat Prevention >> Exploit Prevention >> "Enable Generic Privilege Escalation Prevention" check box. Click "Save".

Additional Identifiers

Rule ID: SV-230206r1022741_rule

Vulnerability ID: V-230206

Group Title: SRG-APP-000272

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.