The Exchange malware scanning agent must be configured for automatic updates.
An XCCDF Rule
Description
<VulnDiscussion>Antimalware protection in Exchange Server 2019 helps combat viruses and spyware in an email messaging environment. Viruses infect other programs and data, and they spread throughout computer looking for programs to infect. Spyware gathers personal information (for example, sign-in information and personal data) and sends it back to its author. The antimalware protection in Exchange Server was introduced in Exchange 2013 and is provided by the Transport agent named Malware Agent. The agent scans messages as they travel through the Transport service on a Mailbox server. To ensure increased effectiveness of the Malware Agent, ensuring its signatures are automatically updated is imperative. Not doing so can lead to system compromise. The Malware agent is installed during the initial installation of Microsoft Exchange server and if installed, is set for automatic updates by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-259695r1015277_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
In an elevated Exchange management shell, run the following cmdlet:
Set-MalwareFilteringServer -Identity <Identity> -UpdateFrequency <integer>
Where <Identity> is the name of the Exchange Server and <integer> is the update frequency (in minutes).