The macOS system must use an approved antivirus program.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257224	APPL-13-002070	SV-257224r905305_rule		High

Description
An approved antivirus product must be installed and configured to run. Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.

STIG	Date
Apple macOS 13 (Ventura) Security Technical Implementation Guide	2023-06-20

Details

Check Text ( C-60909r905303_chk )
Verify the macOS system has the XProtect service running with the following command: /bin/launchctl list \| /usr/bin/grep -cE "(com.apple.XprotectFramework.PluginService\|com.apple.Xprotect.daemon.scan)" If the results show "1", the XProtect Service is running. If the XProtect service is running, verify that it is configured to update automatically by using the following command: /usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist \| /usr/bin/grep "ConfigDataInstall" ConfigDataInstall = 1; If the XProtect service is being used and "ConfigDataInstall" is not set to "1", this is a finding. If XProtect is not active on the system, ask the System Administrator (SA) or Information System Security Officer (ISSO) if an approved antivirus solution is loaded on the system. The antivirus solution may be bundled with an approved host-based security solution. If there is no local antivirus solution installed on the system, this is a finding.

Check Text ( C-60909r905303_chk )

Verify the macOS system has the XProtect service running with the following command:

/bin/launchctl list | /usr/bin/grep -cE "(com.apple.XprotectFramework.PluginService|com.apple.Xprotect.daemon.scan)"

If the results show "1", the XProtect Service is running.

If the XProtect service is running, verify that it is configured to update automatically by using the following command:

/usr/bin/defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist | /usr/bin/grep "ConfigDataInstall"

ConfigDataInstall = 1;

If the XProtect service is being used and "ConfigDataInstall" is not set to "1", this is a finding.

If XProtect is not active on the system, ask the System Administrator (SA) or Information System Security Officer (ISSO) if an approved antivirus solution is loaded on the system. The antivirus solution may be bundled with an approved host-based security solution.

If there is no local antivirus solution installed on the system, this is a finding.

Fix Text (F-60850r905304_fix)
Configure the macOS system to automatically update XProtect by installing the "Restrictions Policy" configuration profile. If XProtect is not being used, install an approved antivirus solution on the system.