From 9fce499f4c4a22c303eef15f144f336bb69120c2 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Thu, 6 Aug 2026 13:27:19 +0200 Subject: [PATCH] =?UTF-8?q?rules:=20ANALYZE-SEC-002=20=E2=80=94=20warn=20w?= =?UTF-8?q?hen=20Secure=20Boot=20is=20disabled?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fires on secureboot_status.uefiSecureBootEnabled=false; legacy BIOS devices (registry key absent, agent sets note field) are skipped via precondition. +20 confidence on physical devices. Validated with MCP validate_rule (0 findings) and test_analyze_rule dry-runs: fired at 90 on a physical SecureBoot:False session, silent on a SecureBoot:True session. Co-Authored-By: Claude Fable 5 --- rules/analyze/ANALYZE-SEC-002.json | 78 +++++++++++++++++++++++++++ rules/dist/analyze-rules.json | 87 ++++++++++++++++++++++++++++++ 2 files changed, 165 insertions(+) create mode 100644 rules/analyze/ANALYZE-SEC-002.json diff --git a/rules/analyze/ANALYZE-SEC-002.json b/rules/analyze/ANALYZE-SEC-002.json new file mode 100644 index 00000000..8992eed9 --- /dev/null +++ b/rules/analyze/ANALYZE-SEC-002.json @@ -0,0 +1,78 @@ +{ + "$schema": "../schema/analyze-rule.schema.json", + "ruleId": "ANALYZE-SEC-002", + "title": "Secure Boot is disabled", + "description": "Detects devices enrolling with Secure Boot turned off. Secure Boot is a firmware-level protection against boot-time malware and is a prerequisite for several Windows security features (VBS/Credential Guard, device health attestation) and common Intune compliance policies. Devices that support Secure Boot but have it disabled should be flagged during enrollment. Legacy BIOS devices (no Secure Boot capability) are excluded — the agent marks those with a note field when the SecureBoot registry state key is absent.", + "severity": "warning", + "category": "security", + "version": "1.0.0", + "author": "Autopilot Monitor", + "enabled": true, + "trigger": "single", + "baseConfidence": 70, + "preconditions": [ + { + "source": "event_data", + "eventType": "secureboot_status", + "dataField": "note", + "operator": "not_exists", + "value": "", + "description": "Skip when the agent could not find the SecureBoot state registry key (note field set) — that indicates a legacy BIOS / non-UEFI device where Secure Boot is unsupported rather than disabled, so a warning would not be actionable." + } + ], + "conditions": [ + { + "signal": "secureboot_disabled", + "source": "event_data", + "eventType": "secureboot_status", + "dataField": "uefiSecureBootEnabled", + "operator": "equals", + "value": "false", + "required": true + }, + { + "signal": "physical_device", + "source": "event_data", + "eventType": "hardware_spec", + "dataField": "isVirtualMachine", + "operator": "equals", + "value": "false", + "required": false + } + ], + "confidenceFactors": [ + { "signal": "physical_device", "condition": "exists", "weight": 20 } + ], + "confidenceThreshold": 60, + "explanation": "This device enrolled with **Secure Boot disabled**.\n\nThe firmware reports UEFI mode, but Secure Boot is turned off (`HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\State\\UEFISecureBootEnabled = 0`). Without Secure Boot the boot chain is not verified, which:\n\n- Leaves the device exposed to bootkits and unsigned boot-time code\n- Blocks or weakens Virtualization-based Security (VBS), Credential Guard and Device Health Attestation\n- Typically makes the device **non-compliant** if an Intune compliance policy requires Secure Boot — Conditional Access may then block the user right after enrollment\n\nSecure Boot is usually disabled deliberately in firmware setup (e.g. for imaging, dual-boot or legacy CSM mode) and simply never re-enabled before the device was handed to Autopilot.", + "remediation": [ + { + "title": "Enable Secure Boot in UEFI firmware", + "steps": [ + "Reboot into the UEFI firmware setup (typically F2/F10/F12/Del during boot, or Shift+Restart -> Troubleshoot -> UEFI Firmware Settings)", + "Disable Legacy/CSM boot mode if it is active — Secure Boot requires native UEFI boot", + "Enable Secure Boot and ensure the Microsoft UEFI CA keys are selected (factory default key set)", + "Save, reboot and verify in Windows: msinfo32 -> 'Secure Boot State' = On, or PowerShell Confirm-SecureBootUEFI returns True", + "For Hyper-V test VMs: use a Generation 2 VM and enable Secure Boot in the VM's Security settings (template 'Microsoft Windows')" + ] + }, + { + "title": "Check compliance impact", + "steps": [ + "Review Intune compliance policies assigned to this device for a 'Require Secure Boot' setting", + "If the device stays non-compliant, Conditional Access policies may block sign-in — fix firmware settings before user handover" + ] + } + ], + "relatedDocs": [ + { + "title": "Microsoft Learn: Secure Boot", + "url": "https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot" + }, + { + "title": "Microsoft Learn: Re-enable Secure Boot", + "url": "https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot" + } + ], + "tags": ["security", "secureboot", "firmware", "uefi", "compliance"] +} diff --git a/rules/dist/analyze-rules.json b/rules/dist/analyze-rules.json index fe751a62..ccb44395 100644 --- a/rules/dist/analyze-rules.json +++ b/rules/dist/analyze-rules.json @@ -2416,6 +2416,93 @@ "compliance" ] }, + { + "ruleId": "ANALYZE-SEC-002", + "title": "Secure Boot is disabled", + "description": "Detects devices enrolling with Secure Boot turned off. Secure Boot is a firmware-level protection against boot-time malware and is a prerequisite for several Windows security features (VBS/Credential Guard, device health attestation) and common Intune compliance policies. Devices that support Secure Boot but have it disabled should be flagged during enrollment. Legacy BIOS devices (no Secure Boot capability) are excluded — the agent marks those with a note field when the SecureBoot registry state key is absent.", + "severity": "warning", + "category": "security", + "version": "1.0.0", + "author": "Autopilot Monitor", + "enabled": true, + "trigger": "single", + "baseConfidence": 70, + "preconditions": [ + { + "source": "event_data", + "eventType": "secureboot_status", + "dataField": "note", + "operator": "not_exists", + "value": "", + "description": "Skip when the agent could not find the SecureBoot state registry key (note field set) — that indicates a legacy BIOS / non-UEFI device where Secure Boot is unsupported rather than disabled, so a warning would not be actionable." + } + ], + "conditions": [ + { + "signal": "secureboot_disabled", + "source": "event_data", + "eventType": "secureboot_status", + "dataField": "uefiSecureBootEnabled", + "operator": "equals", + "value": "false", + "required": true + }, + { + "signal": "physical_device", + "source": "event_data", + "eventType": "hardware_spec", + "dataField": "isVirtualMachine", + "operator": "equals", + "value": "false", + "required": false + } + ], + "confidenceFactors": [ + { + "signal": "physical_device", + "condition": "exists", + "weight": 20 + } + ], + "confidenceThreshold": 60, + "explanation": "This device enrolled with **Secure Boot disabled**.\n\nThe firmware reports UEFI mode, but Secure Boot is turned off (`HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\State\\UEFISecureBootEnabled = 0`). Without Secure Boot the boot chain is not verified, which:\n\n- Leaves the device exposed to bootkits and unsigned boot-time code\n- Blocks or weakens Virtualization-based Security (VBS), Credential Guard and Device Health Attestation\n- Typically makes the device **non-compliant** if an Intune compliance policy requires Secure Boot — Conditional Access may then block the user right after enrollment\n\nSecure Boot is usually disabled deliberately in firmware setup (e.g. for imaging, dual-boot or legacy CSM mode) and simply never re-enabled before the device was handed to Autopilot.", + "remediation": [ + { + "title": "Enable Secure Boot in UEFI firmware", + "steps": [ + "Reboot into the UEFI firmware setup (typically F2/F10/F12/Del during boot, or Shift+Restart -> Troubleshoot -> UEFI Firmware Settings)", + "Disable Legacy/CSM boot mode if it is active — Secure Boot requires native UEFI boot", + "Enable Secure Boot and ensure the Microsoft UEFI CA keys are selected (factory default key set)", + "Save, reboot and verify in Windows: msinfo32 -> 'Secure Boot State' = On, or PowerShell Confirm-SecureBootUEFI returns True", + "For Hyper-V test VMs: use a Generation 2 VM and enable Secure Boot in the VM's Security settings (template 'Microsoft Windows')" + ] + }, + { + "title": "Check compliance impact", + "steps": [ + "Review Intune compliance policies assigned to this device for a 'Require Secure Boot' setting", + "If the device stays non-compliant, Conditional Access policies may block sign-in — fix firmware settings before user handover" + ] + } + ], + "relatedDocs": [ + { + "title": "Microsoft Learn: Secure Boot", + "url": "https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot" + }, + { + "title": "Microsoft Learn: Re-enable Secure Boot", + "url": "https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot" + } + ], + "tags": [ + "security", + "secureboot", + "firmware", + "uefi", + "compliance" + ] + }, { "ruleId": "ANALYZE-SEC-003", "title": "AutoLogon plaintext password stored in registry",