Microsoft Windows 11 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handli...Rule High Severity -
The Windows PowerShell 2.0 feature must be disabled on the system.
Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade ...Rule Medium Severity -
The Server Message Block (SMB) v1 protocol must be disabled on the system.
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS complian...Rule Medium Severity -
Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
Using applications that access the internet or have potential internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running...Rule High Severity -
The Windows 11 time service must synchronize with an appropriate DOD time source.
The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize...Rule Low Severity -
The period of time before the bad logon counter is reset must be configured to 15 minutes.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the cou...Rule Medium Severity -
The system must be configured to audit Account Logon - Credential Validation failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Detailed Tracking - PNP Activity successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Logon/Logoff - Group Membership successes.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity -
The system must be configured to audit Logon/Logoff - Logon failures.
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. A...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.