DET-H18: Measured boot changed on a host¶
A bare-metal host's verified TPM quote shows different SHA-256 PCR 0-7 values than its previous verified quote under the same attestation key: the firmware, an option ROM, the boot loader or the Secure Boot policy changed. Expected after a firmware or boot update; anything else is a boot chain that changed underneath the workload. A new AK is a new identity and starts a new baseline instead.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · TPM quote |
| Related | TPM-MEAS-01 |
Fires when¶
a verified TPM quote's PCR 0-7 != the host's previous verified quote (same AK)
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.