Controlled folder access is enabled in block mode

Overview

Controlled folder access is a Microsoft Defender Antivirus protection that checks apps against a trusted list before allowing changes to protected folders. Microsoft describes it as a way to protect valuable data from malicious apps and threats such as ransomware, with default protected locations and administrator-defined additions. This matters because threat actors who reach execution often try to encrypt or destroy user and business files during the impact stage. If controlled folder access is disabled or only auditing, untrusted processes can still write to protected locations, so a ransomware event can complete before response teams intervene. The control is not a full backup strategy, and it can require allow rules for trusted line-of-business apps that write to user folders. It is still an important last endpoint barrier because it blocks unauthorized write activity where high-value files are commonly stored. This check uses the pinned MDATP Secure Score control scid_2021 to evaluate the tenant-level Microsoft signal.

Remediation

• Protect important folders with controlled folder access
• Configure controlled folder access
• Monitor controlled folder access activity

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Medium
Pillar	SecOps
Category	Endpoint threat protection
Product	Defender
Feature	Endpoint antivirus
Area	Devices and endpoints
ATT&CK	T1486 Data Encrypted for Impact, T1485 Data Destruction
Licence	WINDEFATP, MDE_LITE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.