MT.1148 - Archive Scanning should be enabled

Overview

Verify that archive scanning is enabled to detect malware in compressed files.

Disabled archive scanning allows malware to hide in compressed files (ZIP, RAR, etc.)

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Enable Allow Archive Scanning

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1148
Severity	High
Suite	Maester
Category	Defender
PowerShell test	Test-MtMdeArchiveScanning
Tags	Defender, Maester, MT.1148

Source

• Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
• PowerShell source: powershell/public/maester/defender/Test-MtMdeArchiveScanning.ps1