Devices with critical credentials should be protected by TPM

Contributed by Robbe Van den Daele with Sam ErdeAll contributors →

Part of Maester · Defender · Exposure Management · All checks

Run this check

Invoke-Maester -TestId MT.1088

Overview

Devices shown in the output are devices where a TPM (Trusted Platform Module) is not enabled, but contains credentials of critical accounts. When critical credentials are stored on devices without a TPM enabled, it is more easy for adversaries to steal those credentials when the device is compromised.

How to fix

Investigate the related devices and the steps that need to be taken in order to enable TPM support. This varies depending on operating system, hardware, and device. For more detailed results, you can manually run the following query in advanced hunting.

Details

Every attribute of this check

Field	Value
Test ID	MT.1088
Severity	Medium
Suite	Maester
Product	Defender
Feature	Exposure Management
Area	Devices and endpoints
Resource type	Device
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1552.004 Private Keys
PowerShell test	Test-MtXspmCriticalCredentialsOnNonTpmProtectedDevices
Services	Graph
Long running	Yes

Source

• Test: tests/maester/xspm/Test.MT.1088.ps1
• Documentation: tests/maester/xspm/Test.MT.1088.md