mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 13:10:13 +00:00
Oliver Kieselbach
2e3c0b8db6
Detects a SYSTEM console opened during enrollment — the classic Shift+F10 OOBE bypass (winlogon.exe spawning cmd.exe as SYSTEM). Two complementary Warning signals, one per-tenant toggle EnableConsoleBypassDetection (default ON / opt-out), ConfigVersion 31 -> 32: - oobe_console_spawned (live): ConsoleBypassWatcher + ConsoleBypassHost. WMI Win32_ProcessStartTrace on cmd.exe + startup probe; flags only a cmd.exe whose parent is winlogon.exe. PID dedup happens ONLY after a confirmed winlogon match, so an ignored cmd cannot suppress a later real one via PID reuse. - console_prefetch_detected (startup forensic): ConsolePrefetchScanner (IAgentAnalyzer). A CMD.EXE-*.pf prefetch artifact whose last-run is after boot, covering the pre-agent OOBE window the live watcher misses. stat-only; corroborating artifacts sorted for a stable gate fingerprint. Both events carry coverageComplete:false + an honest coverageNote (and the prefetch event attribution:"coarse") — detection is best-effort, not gapless, and only reports, never blocks. Plumbing: Constants (2 event types) + MCP resource-catalog.ts + Web eventTypes.ts; AnalyzerConfiguration/TenantConfiguration + GetAgentConfig (default true) + TableConfigRepository; DefaultComponentFactory host gate + AgentAnalyzerManager registration; full Web opt-out toggle. Tests: watcher classification (9) + prefetch scanner (7) + analyzer-manager on/off. Also fix(web): unrestricted-mode toggle persisted the stale pre-toggle value because onSave() read async React state. saveConfiguration now takes an explicit unrestrictedMode override that the toggle passes through, so the saved value matches the UI state. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>