Skip to content

Commit

Permalink
Automated ingestion of profiles
Browse files Browse the repository at this point in the history 
Signed-off-by: MITRE SAF <[email protected]>
  • Loading branch information
MITRE SAF committed Nov 14, 2024
1 parent c812cdc commit 20357ef
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/assets/data/baselineProfiles/microsoft-windows-server-2019-stig-baseline.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8918,7 +8918,7 @@
"Rev_4"
]
},
"code": "control 'V-93241' do\n title \"Windows Server 2019 hardened Universal Naming Convention (UNC) paths\n must be defined to require mutual authentication and integrity for at least the\n \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\"\n desc \"Additional security requirements are applied to UNC paths specified in\n hardened UNC paths before allowing access to them. This aids in preventing\n tampering with or spoofing of connections to these paths.\"\n desc 'rationale', ''\n desc 'check', \"This requirement is applicable to domain-joined systems. For standalone\n systems, this is NA.\n\n If the following registry values do not exist or are not configured as\n specified, this is a finding:\n\n Registry Hive: HKEY_LOCAL_MACHINE\n Registry Path:\n \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Additional entries would not be a finding.\"\n desc 'fix', \"Configure the policy value for Computer Configuration >> Administrative\n Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to\n \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths\\\"\n (click the \\\"Show\\\" button to display):\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\"\n impact 0.5\n tag 'severity': nil\n tag 'gtitle': 'SRG-OS-000480-GPOS-00227'\n tag 'gid': 'V-93241'\n tag 'rid': 'SV-103329r1_rule'\n tag 'stig_id': 'WN19-CC-000080'\n tag 'fix_id': 'F-99487r1_fix'\n tag 'cci': ['CCI-000366']\n tag 'nist': ['CM-6 b', 'Rev_4']\n\n is_domain = command('wmic computersystem get domain | FINDSTR /V Domain').stdout.strip\n keyvalue_netlogon = '\\\\\\\\*\\\\NETLOGON'\n keyvalue_sysvol = '\\\\\\\\*\\\\SYSVOL'\n\n if is_domain == 'WORKGROUP'\n impact 0.0\n describe 'The system is not a member of a domain, control is NA' do\n skip 'The system is not a member of a domain, control is NA'\n end\n else\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property keyvalue_sysvol }\n its(keyvalue_sysvol) { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property keyvalue_netlogon }\n its(keyvalue_netlogon) { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n end\nend\n",
"code": "control 'V-93241' do\n title \"Windows Server 2019 hardened Universal Naming Convention (UNC) paths\n must be defined to require mutual authentication and integrity for at least the\n \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\"\n desc \"Additional security requirements are applied to UNC paths specified in\n hardened UNC paths before allowing access to them. This aids in preventing\n tampering with or spoofing of connections to these paths.\"\n desc 'rationale', ''\n desc 'check', \"This requirement is applicable to domain-joined systems. For standalone\n systems, this is NA.\n\n If the following registry values do not exist or are not configured as\n specified, this is a finding:\n\n Registry Hive: HKEY_LOCAL_MACHINE\n Registry Path:\n \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Additional entries would not be a finding.\"\n desc 'fix', \"Configure the policy value for Computer Configuration >> Administrative\n Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to\n \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths\\\"\n (click the \\\"Show\\\" button to display):\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\"\n impact 0.5\n tag 'severity': nil\n tag 'gtitle': 'SRG-OS-000480-GPOS-00227'\n tag 'gid': 'V-93241'\n tag 'rid': 'SV-103329r1_rule'\n tag 'stig_id': 'WN19-CC-000080'\n tag 'fix_id': 'F-99487r1_fix'\n tag 'cci': ['CCI-000366']\n tag 'nist': ['CM-6 b', 'Rev_4']\n\n is_domain = command('wmic computersystem get domain | FINDSTR /V Domain').stdout.strip\n\n if is_domain == 'WORKGROUP'\n impact 0.0\n describe 'The system is not a member of a domain, control is NA' do\n skip 'The system is not a member of a domain, control is NA'\n end\n else\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property '\\\\\\\\*\\\\SYSVOL' }\n its('\\\\\\\\*\\\\SYSVOL') { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property '\\\\\\\\*\\\\NETLOGON' }\n its('\\\\\\\\*\\\\NETLOGON') { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n end\nend\n",
"source_location": {
"ref": "./Windows 2019 STIG/controls/V-93241.rb",
"line": 3
Expand Down Expand Up @@ -12769,7 +12769,7 @@
"id": "controls/V-93185.rb"
}
],
"sha256": "8bf3fefe7af6722dae368ecdcf49df132ee9dbe85459235188a12e3adc1c6010",
"sha256": "3b82a0846d74ce672f8057bc362c5a08079d0596e4032705f4e7ea41b7db2aad",
"status_message": "",
"status": "loaded",
"generator": {
Expand Down

0 comments on commit 20357ef

Please sign in to comment.