MT.1152 - Script Scanning should be enabled

Overview

Verify that script scanning is enabled to block malicious scripts.

Disabled script scanning allows malicious PowerShell, JavaScript, and VBScript execution.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Enable Allow Script Scanning

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1152
Severity	High
Suite	Maester
Category	Defender
PowerShell test	Test-MtMdeScriptScanning
Tags	Defender, Maester, MT.1152

Source

• Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
• PowerShell source: powershell/public/maester/defender/Test-MtMdeScriptScanning.ps1