Adam BaaliandClaude
d8c6f96033
## Summary Adds detection and mitigation for YellowKey (CVE-2026-45585), an unpatched BitLocker bypass affecting Windows 11, Server 2022, and Server 2025. This PR provides: 1. **Detection via osquery extension**: A policy that ensures the `windows_yellowkey` extension is loaded, enabling daily reporting on host exposure status 2. **Daily report**: Surfaces per-host YellowKey verdict (not affected, mitigated, mitigated via WinRE disabled, BitLocker off, or exposed) 3. **Mitigation script**: Implements Microsoft's official mitigation by stripping `autofstx.exe` from WinRE's `BootExecute` registry chain 4. **Installation script**: Downloads and registers the upstream `windows_yellowkey` osquery extension from `allenhouchins/fleet-extensions` The user-facing article is tracked in a separate issue and will land in its own PR. The `docs/solutions/all/queries/` → `reports/` directory migration will also be done in a separate PR. ## Changes ### New files - `docs/solutions/windows/scripts/mitigate-windows-yellowkey.ps1` — PowerShell script that mounts WinRE, loads the offline SYSTEM hive, strips `autofstx` from every ControlSet's `BootExecute`, verifies via read-back, unmounts with commit, and re-seals the BitLocker measurement chain via `reagentc /disable` + `/enable`. Writes `HKLM\SOFTWARE\Fleet\YellowKey\BootExecMitigated = 1` on success. Exit codes: 0 (done), 3 (OS not affected), 4 (failed). - `docs/solutions/windows/scripts/install-yellowkey-extension.ps1` — Wrapper that fetches and executes the upstream installer from `allenhouchins/fleet-extensions/main`. The upstream script handles download, PE-header validation, service stop/restart, ACL hardening, and loader registration. This wrapper exists only because Fleet's GitOps `run_script` requires a file on disk. - `docs/solutions/windows/policies/windows-yellowkey-extension.policies.yml` — Policy that checks `osquery_registry` for the `windows_yellowkey` table. Passes when loaded; failing hosts run the installer. - `docs/solutions/windows/reports/windows-yellowkey.reports.yml` — Daily report querying the extension's `state`, `state_reason`, `needs_action`, `winre_enabled`, `tpm_only`, and `mitigated` columns. ## Design notes - **No opt-in gate**: Microsoft's `autofstx` strip is safe on every affected host, so the mitigation script runs unconditionally. - **One-way mitigation**: No unmitigate path. When Microsoft ships a patch, apply it and clear the marker. - **Extension sourcing**: The extension binary and installer live upstream in `allenhouchins/fleet-extensions/windows_yellowkey`. Allen's CI republishes on every push to `main`. The installer always pulls from `releases/latest/download`, so no edits to this repo are needed when the binary updates. - **Loader path**: The installer writes to `C:\Program Files\osquery\extensions.load` (osquery's compiled default), not to orbit's directory, avoiding conflicts with TUF-managed extensions. - **Hive and mount cleanup**: Mount, hive load, edit, and unmount all run inside a single try/finally block to ensure cleanup even on exception. - **Read-back verification**: Each ControlSet's `BootExecute` is verified after the strip to confirm. https://claude.ai/code/session_016QZzDFsd1hTrYkQukGon6Y <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Windows YellowKey BitLocker bypass vulnerability detection and reporting capabilities * New policy to verify security extension installation and status on Windows hosts * New report surfaces vulnerability exposure and state across Windows fleet * Added automated remediation for vulnerable hosts, including extension installation and bypass mitigation procedures <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46358?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude <noreply@anthropic.com>
Solutions
Best Practices
General
- Name the file what the profile does.
- For example, instead of
googlePlayProtectVerifyApps.json(the name of the Android policy for this control), describe what it does:enforce-google-play-protect.json.
- For example, instead of
- Use kebab case in file names, with all letters in lowercase.
- Instead of
passwordPolicy.json, usepassword-policy.json.
- Instead of
- Be sure to end files with an empty newline.
symlinks
If a solution is applicable to multiple platforms, keep the original in the main platform directory and symlink it to the other platforms. For example, if an Apple configuration profile can be used on both macOS and iOS, use macOS as the source, and create a symlink in the iOS directory.
cd docs/solutions/ios-ipados/configuration-profiles/- Note that this is the destination that we want the symlink to be in.
ln -s ../../macos/configuration-profiles/my-profile.mobileconfig .- The
.here at the end means the current directory, and will use the same file name as the original (which is what we want).
- The
git add profile.mobileconfiggit commit