DET-A5: Attestation provider policy changed¶
A Microsoft Azure Attestation provider's policy was set or reset. The policy decides which SEV-SNP / TDX measurements and claims are accepted, so a change can admit an unmeasured or attacker-chosen image.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Activity Log · Attestation |
| Related | AZURE-MAA-01 |
Fires when¶
Microsoft.Attestation provider policy set or reset
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.