The McAfee MOVE AV On Demand Scan policy must be configured to delete files automatically and quarantine as the first response of a threat detection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-78483	MV45-ODS-200005	SV-93189r1_rule		Medium

Description
Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts. Deleting files found to contain malware while also moving them to quarantine will allow the files to be rendered useless but recoverable in the event of a false positive.

Description

Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Disinfecting a file is generally preferable to quarantining it because the malware is removed and the original file restored; however, many infected files cannot be disinfected. The primary goal of eradication is to remove malware from infected hosts. Deleting files found to contain malware while also moving them to quarantine will allow the files to be rendered useless but recoverable in the event of a false positive.

STIG	Date
McAfee MOVE AV Agentless 4.5 Security Technical Implementation Guide	2017-12-01

Details

Check Text ( C-78045r1_chk )
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus 4.5.0" from the Product list. From the Category list, select "On Demand Scan". Select each configured On Demand Scan policy. Click "Show Advanced". Under "Actions", verify "Threat detection first response" is configured for "Delete files automatically and quarantine". If "Threat detection first response" is not configured for "Delete files automatically and quarantine", this is a finding.

Check Text ( C-78045r1_chk )

Access the McAfee ePO console.

Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus 4.5.0" from the Product list.

From the Category list, select "On Demand Scan".

Select each configured On Demand Scan policy.

Click "Show Advanced".

Under "Actions", verify "Threat detection first response" is configured for "Delete files automatically and quarantine".

If "Threat detection first response" is not configured for "Delete files automatically and quarantine", this is a finding.

Fix Text (F-85217r1_fix)
Access the McAfee ePO console. Select Menu >> Policy >> Policy Catalog and then select "MOVE AntiVirus 4.5.0" from the Product list. From the Category list, select "On Demand Scan". Select each configured On Demand Scan policy. Click "Show Advanced". Under "Actions", configure "Threat detection first response" for "Delete files automatically and quarantine". Click "Save".