DET-A3: Confidential VM protection weakened or absent¶
A virtual machine write left the workload without securityType ConfidentialVM, or with Secure Boot or the vTPM disabled: the measured boot the attestation relies on is no longer enforced (covers both SEV-SNP and TDX confidential VMs).
| Property | Value |
|---|---|
| Severity | high |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Activity Log · Compute |
| Related | AZURE-CVM-01 |
Fires when¶
VM write AND securityType != ConfidentialVM OR vTPM/SecureBoot disabled
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.