Adam BaaliandClaude
d8c6f96033
## Summary Adds detection and mitigation for YellowKey (CVE-2026-45585), an unpatched BitLocker bypass affecting Windows 11, Server 2022, and Server 2025. This PR provides: 1. **Detection via osquery extension**: A policy that ensures the `windows_yellowkey` extension is loaded, enabling daily reporting on host exposure status 2. **Daily report**: Surfaces per-host YellowKey verdict (not affected, mitigated, mitigated via WinRE disabled, BitLocker off, or exposed) 3. **Mitigation script**: Implements Microsoft's official mitigation by stripping `autofstx.exe` from WinRE's `BootExecute` registry chain 4. **Installation script**: Downloads and registers the upstream `windows_yellowkey` osquery extension from `allenhouchins/fleet-extensions` The user-facing article is tracked in a separate issue and will land in its own PR. The `docs/solutions/all/queries/` → `reports/` directory migration will also be done in a separate PR. ## Changes ### New files - `docs/solutions/windows/scripts/mitigate-windows-yellowkey.ps1` — PowerShell script that mounts WinRE, loads the offline SYSTEM hive, strips `autofstx` from every ControlSet's `BootExecute`, verifies via read-back, unmounts with commit, and re-seals the BitLocker measurement chain via `reagentc /disable` + `/enable`. Writes `HKLM\SOFTWARE\Fleet\YellowKey\BootExecMitigated = 1` on success. Exit codes: 0 (done), 3 (OS not affected), 4 (failed). - `docs/solutions/windows/scripts/install-yellowkey-extension.ps1` — Wrapper that fetches and executes the upstream installer from `allenhouchins/fleet-extensions/main`. The upstream script handles download, PE-header validation, service stop/restart, ACL hardening, and loader registration. This wrapper exists only because Fleet's GitOps `run_script` requires a file on disk. - `docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml` — Policy that checks `osquery_registry` for the `windows_yellowkey` table. Passes when loaded; failing hosts run the installer. - `docs/solutions/windows/reports/windows-yellowkey.reports.yml` — Daily report querying the extension's `state`, `state_reason`, `needs_action`, `winre_enabled`, `tpm_only`, and `mitigated` columns. ## Design notes - **No opt-in gate**: Microsoft's `autofstx` strip is safe on every affected host, so the mitigation script runs unconditionally. - **One-way mitigation**: No unmitigate path. When Microsoft ships a patch, apply it and clear the marker. - **Extension sourcing**: The extension binary and installer live upstream in `allenhouchins/fleet-extensions/windows_yellowkey`. Allen's CI republishes on every push to `main`. The installer always pulls from `releases/latest/download`, so no edits to this repo are needed when the binary updates. - **Loader path**: The installer writes to `C:\Program Files\osquery\extensions.load` (osquery's compiled default), not to orbit's directory, avoiding conflicts with TUF-managed extensions. - **Hive and mount cleanup**: Mount, hive load, edit, and unmount all run inside a single try/finally block to ensure cleanup even on exception. - **Read-back verification**: Each ControlSet's `BootExecute` is verified after the strip to confirm. https://claude.ai/code/session_016QZzDFsd1hTrYkQukGon6Y <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Windows YellowKey BitLocker bypass vulnerability detection and reporting capabilities * New policy to verify security extension installation and status on Windows hosts * New report surfaces vulnerability exposure and state across Windows fleet * Added automated remediation for vulnerable hosts, including extension installation and bypass mitigation procedures <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46358?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude <noreply@anthropic.com>
Fleet documentation
Welcome to the documentation for Fleet, the lightweight management platform for laptops and servers.
You can also read the Fleet docs over at https://fleetdm.com/docs.
Using Fleet
Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API.
Deploying
Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios.
Contributing
If you're interested in interacting with the Fleet source code, you'll find information on modifying and building the code here.
If you have any questions, please don't hesitate to File a GitHub issue or join us on Slack. You can find us in the #fleet channel.