detection.wiki

Defender-DeviceTvmSecureConfigurationAssessmentKB

any: Secure configuration knowledge base

#

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table
DeviceTvmSecureConfigurationAssessmentKB

Representative record #

{
  "ConfigurationBenchmarks": [
    "CIS",
    "STIG"
  ],
  "ConfigurationBenchmarks@odata.type": "#Collection(String)",
  "ConfigurationCategory": "OS",
  "ConfigurationDescription": "Determines the behavior of the elevation prompt for standard users.",
  "ConfigurationId": "scid-27",
  "ConfigurationImpact": 8.0,
  "ConfigurationName": "Set User Account Control (UAC) to automatically deny elevation requests",
  "RemediationOptions": "<b>Option 1</b> - Set the following Group Policy:<br/><i>Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\User Account Control\\Behavior of the elevation prompt for standard users</i><br/>To the following value: <i>Automatically deny elevation requests</i><br/><br/><b>Option 2</b> - Set the following registry value:<br/><i>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorUser</i><br/>To the following REG_DWORD value: <i>0</i>",
  "RiskDescription": "Denying elevation requests from standard user accounts requires tasks that need elevation to be initiated by accounts with administrative privileges. This prevents privileged account credentials from being cached with standard user profile information to help mitigate credential theft.",
  "Tags@odata.type": "#Collection(String)"
}

References #