From 20357efb95775e25fedbb23d043b0c98dbc465b0 Mon Sep 17 00:00:00 2001 From: MITRE SAF Date: Thu, 14 Nov 2024 00:06:41 +0000 Subject: [PATCH] Automated ingestion of profiles Signed-off-by: MITRE SAF --- .../microsoft-windows-server-2019-stig-baseline.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/data/baselineProfiles/microsoft-windows-server-2019-stig-baseline.json b/src/assets/data/baselineProfiles/microsoft-windows-server-2019-stig-baseline.json index f1bd2006..bf94c5ca 100644 --- a/src/assets/data/baselineProfiles/microsoft-windows-server-2019-stig-baseline.json +++ b/src/assets/data/baselineProfiles/microsoft-windows-server-2019-stig-baseline.json @@ -8918,7 +8918,7 @@ "Rev_4" ] }, - "code": "control 'V-93241' do\n title \"Windows Server 2019 hardened Universal Naming Convention (UNC) paths\n must be defined to require mutual authentication and integrity for at least the\n \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\"\n desc \"Additional security requirements are applied to UNC paths specified in\n hardened UNC paths before allowing access to them. This aids in preventing\n tampering with or spoofing of connections to these paths.\"\n desc 'rationale', ''\n desc 'check', \"This requirement is applicable to domain-joined systems. For standalone\n systems, this is NA.\n\n If the following registry values do not exist or are not configured as\n specified, this is a finding:\n\n Registry Hive: HKEY_LOCAL_MACHINE\n Registry Path:\n \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Additional entries would not be a finding.\"\n desc 'fix', \"Configure the policy value for Computer Configuration >> Administrative\n Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to\n \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths\\\"\n (click the \\\"Show\\\" button to display):\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\"\n impact 0.5\n tag 'severity': nil\n tag 'gtitle': 'SRG-OS-000480-GPOS-00227'\n tag 'gid': 'V-93241'\n tag 'rid': 'SV-103329r1_rule'\n tag 'stig_id': 'WN19-CC-000080'\n tag 'fix_id': 'F-99487r1_fix'\n tag 'cci': ['CCI-000366']\n tag 'nist': ['CM-6 b', 'Rev_4']\n\n is_domain = command('wmic computersystem get domain | FINDSTR /V Domain').stdout.strip\n keyvalue_netlogon = '\\\\\\\\*\\\\NETLOGON'\n keyvalue_sysvol = '\\\\\\\\*\\\\SYSVOL'\n\n if is_domain == 'WORKGROUP'\n impact 0.0\n describe 'The system is not a member of a domain, control is NA' do\n skip 'The system is not a member of a domain, control is NA'\n end\n else\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property keyvalue_sysvol }\n its(keyvalue_sysvol) { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property keyvalue_netlogon }\n its(keyvalue_netlogon) { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n end\nend\n", + "code": "control 'V-93241' do\n title \"Windows Server 2019 hardened Universal Naming Convention (UNC) paths\n must be defined to require mutual authentication and integrity for at least the\n \\\\\\\\*\\\\SYSVOL and \\\\\\\\*\\\\NETLOGON shares.\"\n desc \"Additional security requirements are applied to UNC paths specified in\n hardened UNC paths before allowing access to them. This aids in preventing\n tampering with or spoofing of connections to these paths.\"\n desc 'rationale', ''\n desc 'check', \"This requirement is applicable to domain-joined systems. For standalone\n systems, this is NA.\n\n If the following registry values do not exist or are not configured as\n specified, this is a finding:\n\n Registry Hive: HKEY_LOCAL_MACHINE\n Registry Path:\n \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\NetworkProvider\\\\HardenedPaths\\\\\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value Type: REG_SZ\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Additional entries would not be a finding.\"\n desc 'fix', \"Configure the policy value for Computer Configuration >> Administrative\n Templates >> Network >> Network Provider >> \\\"Hardened UNC Paths\\\" to\n \\\"Enabled\\\" with at least the following configured in \\\"Hardened UNC Paths\\\"\n (click the \\\"Show\\\" button to display):\n\n Value Name: \\\\\\\\*\\\\SYSVOL\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\n\n Value Name: \\\\\\\\*\\\\NETLOGON\n Value: RequireMutualAuthentication=1, RequireIntegrity=1\"\n impact 0.5\n tag 'severity': nil\n tag 'gtitle': 'SRG-OS-000480-GPOS-00227'\n tag 'gid': 'V-93241'\n tag 'rid': 'SV-103329r1_rule'\n tag 'stig_id': 'WN19-CC-000080'\n tag 'fix_id': 'F-99487r1_fix'\n tag 'cci': ['CCI-000366']\n tag 'nist': ['CM-6 b', 'Rev_4']\n\n is_domain = command('wmic computersystem get domain | FINDSTR /V Domain').stdout.strip\n\n if is_domain == 'WORKGROUP'\n impact 0.0\n describe 'The system is not a member of a domain, control is NA' do\n skip 'The system is not a member of a domain, control is NA'\n end\n else\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property '\\\\\\\\*\\\\SYSVOL' }\n its('\\\\\\\\*\\\\SYSVOL') { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n describe registry_key('HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths') do\n it { should have_property '\\\\\\\\*\\\\NETLOGON' }\n its('\\\\\\\\*\\\\NETLOGON') { should cmp 'RequireMutualAuthentication=1, RequireIntegrity=1' }\n end\n end\nend\n", "source_location": { "ref": "./Windows 2019 STIG/controls/V-93241.rb", "line": 3 @@ -12769,7 +12769,7 @@ "id": "controls/V-93185.rb" } ], - "sha256": "8bf3fefe7af6722dae368ecdcf49df132ee9dbe85459235188a12e3adc1c6010", + "sha256": "3b82a0846d74ce672f8057bc362c5a08079d0596e4032705f4e7ea41b7db2aad", "status_message": "", "status": "loaded", "generator": {