Runtime detection rules¶
All 82 detection rules. tee rules watch the attestation boundary (key release, the policy that gates it, what the TEE runs); cloud rules watch the resources around it; hardware rules come from enrolled collectors; supply rules watch image registries.
Source
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).
AWS Nitro Enclaves¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-01 |
high | cloud | CloudTrail · S3 data events | s3:PutObject to state bucket by a non-enclave principal. A write to the bootstrap state from a principal other than the enclave host's role. Needs a trail that logs S3 data events. | BOOTSTRAP-02 |
DET-02 |
critical | tee | CloudTrail · KMS | kms:Decrypt without a RecipientAttestation context. The attestation-gated key released plaintext to a caller that presented no enclave attestation document: key release outside the enclave. | KMS-01 |
DET-03 |
high | cloud | CloudTrail | Instance-role credential use from an unexpected source IP. The enclave host's instance-role credentials were used from an address that is not the host's. | IMDS-01 |
DET-04 |
medium | cloud | CloudTrail · EC2 Instance Connect / SSM | Interactive access attempt on the enclave host. SendSSHPublicKey or an SSM session on the hardened host. | SSH-01 |
DET-05 |
high | cloud | CloudTrail · S3 | Guardrail change on the state bucket. A bucket policy, ACL or public-access-block change on the bootstrap state. | BOOTSTRAP-02 |
DET-06 |
critical | tee | nitro-cli · host signal | Enclave launched with --debug-mode. A debug enclave reports all-zero PCRs and exposes its console, which defeats attestation. | ENCLAVE-01 |
DET-07 |
critical | tee | CloudTrail · KMS | Attested key release to an unreleased enclave measurement. A Decrypt carried an attestation document, but the enclave image digest (PCR0) is not a released build. An unapproved image obtained the key. | KMS-01 |
DET-08 |
critical | tee | CloudTrail · KMS | Attestation condition removed from the key policy. PutKeyPolicy on the state key left a Decrypt-capable statement without a kms:RecipientAttestation condition: the gate on key release was loosened. | KMS-01 |
DET-09 |
critical | tee | CloudTrail · KMS | Grant created on the attestation-gated key. A KMS grant on the state key. Grants are evaluated outside the key policy's attestation conditions, so this is a bypass of the attestation gate. | KMS-01 |
DET-10 |
high | tee | CloudTrail · KMS | Attested key release from an enclave on an unexpected host. The attestation document's module ID names an instance other than the deployment's enclave host: the same image is running somewhere else. | KMS-01 |
DET-11 |
critical | tee | nitro-cli · host signal | Running enclave measurement differs from the released build. nitro-cli reports a PCR0 for the running enclave that is not a released build: the enclave was relaunched from a different image. | ENCLAVE-01 |
DET-12 |
high | tee | CloudTrail · KMS | Attestation key disabled or scheduled for deletion. DisableKey, ScheduleKeyDeletion or DeleteImportedKeyMaterial on the state key: the enclave can no longer obtain its secrets (or tracks are being covered). | KMS-01 |
DET-13 |
critical | tee | CloudTrail · KMS | Attestation measurement re-pinned in the key policy. PutKeyPolicy kept the kms:RecipientAttestation gate but pinned it to a PCR0 / ImageSha384 that is not a released build: key release now trusts another image. | KMS-01 |
DET-14 |
high | tee | CloudTrail · KMS | Attestation key alias repointed or deleted. UpdateAlias moved the state key's alias to a different key, or DeleteAlias removed it: new encryptions stop using the attestation-gated key. | KMS-01 |
DET-15 |
high | cloud | CloudTrail · EC2 | IMDS protection loosened on the enclave host. ModifyInstanceMetadataOptions re-enabled IMDSv1 (HttpTokens optional) or raised the hop limit on the host, making its instance credentials easier to steal. | IMDS-01 |
DET-16 |
high | cloud | CloudTrail · IAM (us-east-1) | Enclave host role permissions changed. An inline policy was written, a managed policy attached, or the trust policy changed on the enclave host's instance role. | IAM-01 |
DET-17 |
high | cloud | CloudTrail · CloudTrail | Audit trail stopped, deleted or narrowed. StopLogging, DeleteTrail, UpdateTrail or PutEventSelectors on a trail: someone may be blinding the logs these detections read. | CLOUDTRAIL-01 |
DET-18 |
medium | cloud | CloudTrail · EC2 | Internet ingress opened to the enclave host. AuthorizeSecurityGroupIngress opened one of the host's security groups to 0.0.0.0/0 or ::/0. | SG-01 |
DET-19 |
critical | tee | CloudTrail · KMS | Data key generated without a RecipientAttestation context. GenerateDataKey or GenerateDataKeyPair on the attestation-gated key returned a plaintext data key to a caller that presented no enclave attestation: the same key-release bypass as DET-02, on the data-key path rather than Decrypt. | KMS-01 |
DET-20 |
critical | tee | CloudTrail · KMS | Attestation-gated key shared cross-account or made public. PutKeyPolicy added a Decrypt-capable statement whose principal is another AWS account's root or '*': an enclave (or caller) outside this account can now obtain the key, which the attestation gate never anticipated. | KMS-01 |
DET-21 |
critical | tee | CloudTrail · KMS | Key administration granted to an external or wildcard principal. PutKeyPolicy granted key-administration actions (PutKeyPolicy, CreateGrant, ScheduleKeyDeletion or kms:*) to another account or '*': that principal can rewrite or destroy the attestation gate itself. | KMS-01 |
DET-22 |
high | cloud | CloudTrail · EC2 | Enclave host disk imaged or snapshotted. CreateImage, CreateSnapshot or CreateSnapshots captured the enclave host's volumes. The host disk holds the bootstrap state, so an image or snapshot lifts it out of the instance's access controls (and can then be shared out). | BOOTSTRAP-02 |
DET-23 |
high | cloud | CloudTrail · EC2 | Enclave host instance profile swapped. AssociateIamInstanceProfile or ReplaceIamInstanceProfileAssociation put a different IAM instance profile on the enclave host: the host now runs as another role, with whatever KMS and S3 access that role carries, without any change to the original role DET-16 watches. | IAM-01 |
Azure confidential VMs¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-A1 |
critical | tee | Azure Activity Log · Key Vault / RBAC | Key release or decrypt granted outside the confidential VM's identity. A Key Vault access policy or role assignment gave a key's release/decrypt/unwrap to a principal other than the confidential VM's managed identity: that principal can obtain the key with no attestation. | AZURE-SKR-01 |
DET-A2 |
critical | tee | Azure Key Vault · AuditEvent (KeyCreate/KeyUpdate) | Secure Key Release policy no longer requires attestation. A key's release policy was created or updated without a Microsoft Azure Attestation authority, or without pinning the TEE claims (SEV-SNP measurement or TDX MRTD): the key releases to a VM whose code was never attested. | AZURE-SKR-01 |
DET-A3 |
high | tee | Azure Activity Log · Compute | Confidential VM protection weakened or absent. A virtual machine write left the workload without securityType ConfidentialVM, or with Secure Boot or the vTPM disabled: the measured boot the attestation relies on is no longer enforced (covers both SEV-SNP and TDX confidential VMs). | AZURE-CVM-01 |
DET-A4 |
high | cloud | Azure Activity Log · Insights | Diagnostic settings removed from an attestation resource. diagnosticSettings were deleted on the Key Vault, confidential VM or attestation provider: the AuditEvent and Activity records these detections read stop being exported. | AZURE-LOG-01 |
DET-A5 |
critical | tee | Azure Activity Log · Attestation | Attestation provider policy changed. A Microsoft Azure Attestation provider's policy was set or reset. The policy decides which SEV-SNP / TDX measurements and claims are accepted, so a change can admit an unmeasured or attacker-chosen image. | AZURE-MAA-01 |
DET-A6 |
medium | cloud | Azure Activity Log · Key Vault | Key Vault opened to public networks. A vault write set its network default action to Allow (public): the vault holding the attestation-gated key is reachable from outside the confidential VM's network. | AZURE-KV-01 |
DET-A7 |
high | cloud | Azure Activity Log · Compute | Confidential VM disk exported or snapshotted. A disk export (beginGetAccess) or snapshot write took the confidential VM's OS disk out of the instance, lifting its state out of the VM's access controls. | AZURE-DISK-01 |
DET-A8 |
critical | tee | Azure Key Vault · AuditEvent / Activity Log | Attestation-gated Key Vault key disabled or deleted. The Key Vault key the confidential VM releases through Secure Key Release was deleted or disabled (KeyDelete, a key attributes update setting enabled=false, or a management-plane keys/delete). Release breaks, and a replacement key can be stood up without the attested release policy — the Azure analog of DET-12 / DET-C5. | AZURE-SKR-01 |
DET-A9 |
critical | tee | Azure Key Vault · AuditEvent (KeyPurge) | Attestation-gated Key Vault key purged. A soft-deleted Key Vault key was purged. Purge is irreversible: the key the confidential VM releases through Secure Key Release cannot be recovered (DET-A8 covers the delete and disable that precede it), and a replacement can be created without the attested release policy. | AZURE-SKR-01 |
GCP Confidential Space¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-C1 |
critical | tee | Cloud Audit Logs · IAM | Attestation condition weakened on the workload identity provider. A Workload Identity provider was created or updated with an attribute condition that no longer pins dbgstat and the workload image digest: key release no longer depends on what code runs. | CSPACE-KEYBIND-01 |
DET-C2 |
critical | tee | Cloud Audit Logs · Compute | Confidential VM launched from the debug image or with log redirect. A Confidential Space VM booted the confidential-space-debug image (SSH, debug attestation) or with tee-container-log-redirect, which streams workload output out of the TEE. | CSPACE-VM-01 |
DET-C3 |
high | tee | Cloud Audit Logs · Compute | Workload image or environment changed on the Confidential VM. setMetadata changed tee-image-reference or a tee-env-* value on the workload VM: the next boot runs different code or configuration. | CSPACE-META-01 |
DET-C4 |
critical | tee | Cloud Audit Logs · Cloud KMS IAM | Key decrypt granted outside the attestation gate. SetIamPolicy on the state key gave decrypt to a member other than the workload identity pool. That member can release the key without any attestation. | CSPACE-KMS-01 |
DET-C5 |
high | tee | Cloud Audit Logs · Cloud KMS | Attestation key version disabled or destroyed. A version of the state key was disabled or scheduled for destruction: the workload can no longer obtain its secrets. | CSPACE-KMS-01 |
DET-C6 |
critical | tee | Cloud Audit Logs · Cloud KMS data access | Key decrypted by a principal outside the workload identity pool. A Decrypt on the state key by an identity that did not federate through the attested pool. Needs Data Access (DATA_READ) audit logs for Cloud KMS. | CSPACE-KMS-01 |
DET-C7 |
critical | tee | Cloud Audit Logs · IAM | Impersonation granted on a service account outside the identity pool. SetIamPolicy on a service account gave token-creator, workload-identity-user or service-account-user to a member outside the workload identity pool: that member can act as the workload without any attestation. | CSPACE-SA-01 |
DET-C8 |
high | cloud | Cloud Audit Logs · Resource Manager | Cloud KMS data access logging turned off. The project IAM policy dropped Data Access audit logging for Cloud KMS: decrypts stop being recorded, which blinds DET-C6. | CSPACE-KMS-01 |
DET-C9 |
high | tee | Cloud Audit Logs · IAM | Attestation gate removed: identity provider or pool deleted. The Workload Identity provider or pool that gates key release was deleted; the workload can no longer obtain its key (or the gate is being replaced). | CSPACE-KEYBIND-01 |
DET-C10 |
critical | tee | Cloud Audit Logs · IAM | Long-lived key created on the workload service account. A user-managed service-account key was created on the workload identity. A static key authenticates with no attestation at all, so it bypasses the workload identity pool and the whole Confidential Space gate. | CSPACE-SA-01 |
DET-C11 |
high | tee | Cloud Audit Logs · Compute | Shielded VM protection weakened on the workload VM. updateShieldedInstanceConfig turned off Secure Boot or the vTPM on the workload VM: the measured-boot chain the attestation depends on is no longer enforced. | CSPACE-VM-01 |
DET-C12 |
high | cloud | Cloud Audit Logs · Logging | Audit logging blinded by a logging sink or exclusion. A logging exclusion or sink change dropped Data Access or Admin Activity entries for the project: the records these Confidential Space detections read stop arriving. | CSPACE-KMS-01 |
DET-C13 |
high | cloud | Cloud Audit Logs · Compute | Public IP added to the workload Confidential VM. addAccessConfig attached an external (one-to-one NAT or direct IPv6) address to the workload VM, exposing a TEE workload that should only be reached from inside its network. | CSPACE-VM-01 |
DET-C14 |
high | tee | Cloud Audit Logs · Compute | Workload Confidential VM's service account changed. setServiceAccount re-pointed the identity the workload VM runs as (the instance token its metadata serves). The attested workload can now reach whatever the new service account can, with no re-attestation. | CSPACE-SA-01 |
DET-C15 |
high | cloud | Cloud Audit Logs · Compute | Confidential VM disk snapshotted or imaged. A snapshot, image or machine image captured the workload Confidential VM's disk. The disk holds the workload's state, so copying it out of the instance lifts that state out of the VM's confidential boundary and its access controls — the GCP peer of the AWS (DET-22) and Azure (DET-A7) disk-exfil detections. | CSPACE-VM-01 |
Hardware fleets¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-H1 |
high | hardware | Collector · SEV-SNP report | Launch measurement changed on a host. A host's verified launch measurement differs from its previous report: a new guest image or firmware is running. | SNP-MEAS-01 |
DET-H2 |
medium | hardware | Collector · SEV-SNP report / NVIDIA NRAS | Firmware, microcode or VBIOS changed. The reported TCB (bootloader, TEE, SNP firmware, microcode) or the GPU driver or VBIOS version changed between verified reports. | SNP-TCB-01 |
DET-H3 |
critical | hardware | Collector · SEV-SNP report / NVIDIA NRAS | Debug or devtools mode appeared. A guest policy now allows DEBUG or a migration agent, or a GPU reports debugging or CC devtools mode. | SNP-POL-01 |
DET-H4 |
medium | hardware | Collector liveness | Collector stopped reporting or moved hardware. A collector missed an hour of reports, or its key vouched for a different CPU than before. | SNP-CERT-01 |
DET-H5 |
high | hardware | Fleet policy / AMD KDS / NVIDIA RIM | Host fell out of date after a vendor change. An unchanged host stopped meeting its TCB or RIM requirements because the fleet minimum was raised after an advisory or NVIDIA withdrew a RIM. | SNP-TCB-01 |
DET-H6 |
high | hardware | Collector · Redfish (BMC) | BMC or platform firmware flashed. The BMC, BIOS or another component in the BMC's firmware inventory reports a different version than the previous snapshot: firmware outside attestation was replaced. | BMC firmware |
DET-H7 |
medium | hardware | Collector · Redfish (BMC) | BIOS setting changed. A BIOS attribute changed between snapshots. Events that turn off Secure Boot, the TPM, TXT, SME/SEV, TDX or the IOMMU are raised as high. | BIOS settings |
DET-H8 |
high | hardware | Collector · Redfish (BMC) | BMC account added or privilege raised. A BMC account appeared or was enabled, or an account became Administrator or Operator: whoever holds it can reflash firmware and reach the console. | BMC accounts |
DET-H9 |
high | hardware | Collector · Redfish (BMC) | BMC remote access enabled. IPMI-over-LAN, SSH, Telnet, virtual media or KVM-over-IP was turned on at the BMC. | BMC network protocols |
DET-H10 |
medium | hardware | Collector · Redfish (BMC) | Network (PXE) boot moved first. The host will next boot from the network (boot order or a boot override): an attacker on that network can serve it a different image. | Boot order |
DET-H11 |
high | hardware | Collector · sshd auth (journald) | Root login on a TEE host. A successful interactive root login on a host running confidential guests, read from the host's sshd auth log by the collector (opt-in; root only, no command content). Interactive root access is outside the hardened-host baseline. | SSH-01 |
DET-H12 |
high | hardware | Collector · root authorized_keys | New root SSH key authorized. A key was added to root's authorized_keys between two collector snapshots: a new way to log in as root on a host running confidential guests. | SSH-01 |
DET-H13 |
high | hardware | Collector · sshd_config | Root SSH login policy changed. sshd's PermitRootLogin changed between two collector snapshots. A change that loosens root SSH access (e.g. to 'yes') widens the host's interactive-access surface. | SSH-01 |
DET-H14 |
medium | hardware | Collector · root_ssh | Root SSH visibility lost. A collector that was reporting root's SSH state stopped: its root_ssh reader went unreadable, or the opt-in was turned off. DET-H11..H13 go blind while the signal is dark, so an operator knows the signal was lost rather than assuming the host is clean. | SSH-01 |
DET-H15 |
critical | hardware | Relying-party release decision / fleet identity register | Key released to an unregistered host. A key broker released a key to a host whose hardware identity is not enrolled in the fleet's identity register, or is quarantined: the release reached hardware that never passed identity review. | KMS-01 |
DET-H16 |
high | hardware | Collector · in-band OS + Redfish (BMC) | Host and BMC disagree on firmware or boot state. The host's own view (efivars, DMI) and its BMC's Redfish view of the same box disagree on Secure Boot or the BIOS version. Neither view is attested, so one of them is wrong: a tampered OS or BMC, a host that is not the box the BMC manages, or a stale snapshot. | FW-HOST-01 |
DET-H17 |
high | hardware | Collector · local host scan | Collector host check regressed. A local host check (CCHOST-*, BOOT-IN-*, the host checks) passed on the collector's previous scan and fails now: the host itself changed, e.g. SEV-SNP or TDX host support was switched off, a protection was disabled on the kernel command line, or a boot input became writable. Raised at the regressed check's own severity. | CCHOST-01 |
DET-H18 |
medium | hardware | Collector · TPM quote | Measured boot changed on a host. A bare-metal host's verified TPM quote shows different SHA-256 PCR 0-7 values than its previous verified quote under the same attestation key: the firmware, an option ROM, the boot loader or the Secure Boot policy changed. Expected after a firmware or boot update; anything else is a boot chain that changed underneath the workload. A new AK is a new identity and starts a new baseline instead. | TPM-MEAS-01 |
DET-H19 |
high | hardware | Collector · NVIDIA NRAS | GPU measurements stopped matching NVIDIA's reference. A GPU's verified runtime measurements matched NVIDIA's driver and VBIOS reference values on its previous report and no longer do (GPU-RIM-01 PASS to FAIL). With the same driver and VBIOS versions, that is modified GPU firmware: the GPU counterpart of DET-H1, at the same severity. | GPU-RIM-01 |
DET-H20 |
medium | hardware | Collector · verified report | Attestation baseline re-established without a verified prior report. On upgrade, a host whose last stored report did not verify (possibly a forged one) has no state the drift rules (DET-H1/H2/H3/H19) can compare with: reports keep findings, not state, and a writer can file one claiming to be a collector's. Its next verified report re-establishes the baseline (state and check statuses), once, and this names the host and the measurement, firmware and debug values adopted: confirm them, since a change carried by that report was compared with nothing. | SNP-MEAS-01 |
DET-H21 |
medium | hardware | Collector · Redfish (BMC) | BMC baseline unavailable. The collector is configured to read this host's BMC, but no readable snapshot has ever been recorded, so firmware, settings, account, remote-access and boot-order changes (DET-H6 to H10) have nothing to compare with. An unreadable BMC can be an outage, a permission error, or a BMC kept unreadable on purpose to hide a change. | BMC snapshot |
DET-H22 |
medium | hardware | Collector · verified report | Hardware moved between fleets. Verified evidence for hardware another fleet recorded was filed by this fleet's collector, so the hardware moved. It starts afresh in the new fleet (its attestation, BMC and TPM baselines stay with the old one), so a change carried across the move is compared with nothing. Raised once per move to each fleet's readers, each side naming only its own fleet: the old fleet sees the hardware moved out (no destination), the new one sees it moved in (its collector, no source). | Fleet membership |
Image registry¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-R1 |
high | supply | CloudTrail · ECR | Watched tag moved to new content. A tag the registry policy deploys from was pushed again with a different digest, or now points away from the released digest: what deploys under that tag changed. | REG-PIN-01 |
DET-R2 |
high | supply | CloudTrail · ECR | Unsigned image pushed to a watched repository. An image was pushed to a repository the registry policy watches and no signature for its digest followed within the grace period. | REG-SIG-01 |
DET-R3 |
medium | supply | CloudTrail · ECR / Cloud Audit Logs · Artifact Registry | Tag immutability turned off. PutImageTagMutability to MUTABLE (ECR) or an UpdateRepository that disables immutable tags (Artifact Registry): released tags can now be overwritten. | REG-PIN-01 |
DET-R4 |
high | supply | CloudTrail · ECR / Cloud Audit Logs · Artifact Registry | Repository opened to everyone or another account. A repository policy now allows any principal or a foreign account (ECR), or allUsers / allAuthenticatedUsers (Artifact Registry): anyone named can pull, or push, what the TEE boots. | REG-ACCESS-01 |
Key broker (KBS)¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-K1 |
critical | tee | KBS · release event | Key released without a bound measurement. A key broker released a secret but recorded no attestation measurement it gated on: the release was not bound to an attested workload. | KBS-01 |
DET-K2 |
high | tee | KBS · release event | Key released against a debug or all-zero measurement. A key broker released a secret against an all-zero / debug measurement: the receiving TEE was not in a verified production state. | KBS-01 |
NVIDIA GPU CC¶
| Rule | Severity | Group | Source | Fires when | Related check |
|---|---|---|---|---|---|
DET-G1 |
critical | tee | GPU evidence capture | GPU left production CC mode. The GPU was in CC-On in the previous capture and is now in CC-DevTools or CC-Off: GPU memory and execution are exposed while the workload keeps running. | GPUCC-MODE-01 |
DET-G2 |
high | tee | GPU evidence capture | A different GPU is behind the deployment. The attested device identity (ueid, else UUID) differs from the previous capture: the host attached another GPU to the confidential VM. | GPUCC-BIND-01 |
DET-G3 |
high | tee | GPU evidence capture | MIG partitioning appeared on the confidential GPU. MIG is now enabled, or pending for the next GPU reset, where the previous capture had it off: the GPU is about to be shared inside one trust boundary. | GPUCC-MIG-01 |
DET-G4 |
critical | tee | GPU evidence capture · nvattest receipt | Attestation result replayed. A capture's attestation receipt reuses the nonce or raw-result digest of an earlier capture: an old passing result was presented again instead of attesting afresh. | GPUCC-SIGVERIFY-01 |
DET-G5 |
critical | tee | GPU evidence capture · CUDA receipt | CUDA ran without a valid attestation. The workload recorded CUDA execution, but the runtime attestation chain behind it does not verify: the GPU was used before, or without, a successful nvattest result. | GPUCC-CUDA-01 |
DET-G6 |
medium | tee | GPU evidence capture | GPU driver or VBIOS changed. A driver or VBIOS measurement differs from the previous capture. Expected after a planned update; otherwise a downgrade or swap of the measured firmware. | GPUCC-RIM-01 |
DET-G7 |
medium | tee | GPU evidence capture | GPU attestation went stale. The gap since the previous capture exceeds the allowed maximum, so the GPU ran unattested for longer than the re-attestation policy permits. | GPUCC-REATTEST-01 |