Windows 10 20H2 adds faster malware detection to security baseline

Microsoft announced the security baseline draft release for Windows 10 and Windows Server, version 20H2, as well as the intention to include the Microsoft Defender Antivirus 'Block At First Sight' (BAFS) feature within the new baseline.

The Windows 10 security baseline enables security admins to use Microsoft-recommended Group Policy Object (GPO) baselines to reduce Windows 10's attack surface and for boosting the overall security posture of enterprise endpoints.

"A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact," as Microsoft explains. "These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers."

"The baselines are designed for well-managed, security-conscious organizations in which standard end users do not have administrative rights," Microsoft Federal Customer Success Unit (CSU) Consultant Rick Munck said.

Faster malware detection

While the Microsoft Defender Antivirus BAFS feature was introduced with the release of Windows 10, version 1607 in August 2016, this is the first time Microsoft intends to recommend it as a default setting on enterprise endpoints.

"Based on our analysis of the security value versus the cost of implementation, we feel it is time to add the Microsoft Defender Antivirus block at first sight feature to the security baseline," Munck said.

When enabled on a Windows 10 or Windows Server system, BAFS will greatly decrease the amount of time Microsoft Defender Antivirus will need to detect and block new malware using Microsoft's cloud-based protection service and machine learning.

"When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend," Microsoft explains.

"The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or not a threat."

Security admins can enable BAFS by toggling the following four additional prerequisite settings on top of the 'Join Microsoft MAPS' and 'Send file sample when further analysis is required' ones already enabled by previous baselines:

• Configure the ‘Block at first sight’ feature set to Enabled
• Scan all downloaded files and attachments set to Enabled
• Turn off real-time protection set to Disabled
• Select cloud protection level set to High blocking level

The four BAFS prerequisite settings will be added to the 'MSFT Windows 10 20H2 and Server 20H2 – Defender Antivirus' group policy once the security baseline's final version is released.

New rules for Windows attack surface reduction

With the new security baseline, Microsoft will also recommend admins to enable additional attack surface reduction rules that will also be added to the 'MSFT Windows 10 20H2 and Server 20H2 – Defender Antivirus' group policy.

The first one, the 'Use advanced protection against ransomware' rule is designed to automatically block any file Defender Antivirus tags as malicious unless it's added to an exclusion list.

'Block persistence through WMI event subscription,' the second new attack surface reduction control in the 20H2 security baseline draft, is designed to block threat actors from evading detection by gaining Windows Management Instrumentation (WMI) persistence.

With the release of Windows 10 20H2, admins are also advised to apply the Microsoft Edge security baseline to their systems seeing that the new Chromium-based Microsoft Edge web browser is now delivered as a built-in part of the OS.

A list of all changes that may be included in the final version of the baseline based on tester feedback is available in Microsoft's security guidance blog post.

The Windows 10 20H2 security baseline draft includes GPO backups and reports, scripts to apply settings to the local GPO, and Policy Analyzer rules files, and it can be downloaded from here.

As usual, with each security baseline draft release, Microsoft also includes spreadsheets documenting all security settings and group policies for Windows 10 and Windows Server v2004 "along with the Microsoft-recommended configuration of those settings for well-managed enterprise systems."

Microsoft previously added new account password length security policies to the Windows 10 2004 baseline and removed Exploit Protection settings from the Windows 10 1909 security baseline.