Option 14 — Enabled Security Graph Authorization#

flowchart TD
    subgraph Layer1["Layer 1: Explicit Policy Rules"]
        SignerRule{Signer rule match?}
        HashRule{Hash rule match?}
        PathRule{Path rule match?\nif enabled}
    end

    subgraph Layer2["Layer 2: Dynamic Trust — Option 13"]
        MI_EA{KERNEL.SMARTLOCKER\n.ORIGINCLAIM EA\nbyte[4]==0x00?}
    end

    subgraph Layer3["Layer 3: Dynamic Trust — Option 14"]
        ISG_Cache{Local EA cache\nbyte[4]==0x01\nvalid & not expired?}
        ISG_Cloud{Cloud ISG query\nsp.oci.microsoft.com}
        ISG_Verdict{ISG verdict?}
    end

    subgraph Outcome["Outcome"]
        Allow([Execution Allowed])
        Block([Execution Blocked])
    end

    Exec([File execution attempt]) --> SignerRule
    SignerRule -- Match --> Allow
    SignerRule -- No Match --> HashRule
    HashRule -- Match --> Allow
    HashRule -- No Match --> PathRule
    PathRule -- Match --> Allow
    PathRule -- No Match --> MI_EA

    MI_EA -- EA present, valid --> Allow
    MI_EA -- No EA / byte mismatch --> ISG_Cache

    ISG_Cache -- Cache hit, not expired --> Allow
    ISG_Cache -- Cache miss / expired --> ISG_Cloud
    ISG_Cloud --> ISG_Verdict
    ISG_Verdict -- Known Good --> Allow
    ISG_Verdict -- Unknown --> Block
    ISG_Verdict -- Known Bad --> Block
    ISG_Verdict -- Cloud unreachable --> Block

    style Exec fill:#162032,color:#58a6ff
    style SignerRule fill:#1a1a0d,color:#fde68a
    style HashRule fill:#1a1a0d,color:#fde68a
    style PathRule fill:#1a1a0d,color:#fde68a
    style MI_EA fill:#0d1f12,color:#86efac
    style ISG_Cache fill:#1c1c2e,color:#a5b4fc
    style ISG_Cloud fill:#1c1c2e,color:#a5b4fc
    style ISG_Verdict fill:#1a1a0d,color:#fde68a
    style Allow fill:#0d1f12,color:#86efac
    style Block fill:#1f0d0d,color:#fca5a5

flowchart LR
    O14([Option 14\nISG Authorization])

    O13([Option 13\nManaged Installer])
    O3([Option 3\nAudit Mode])
    O6([Option 6\nUnsigned Policy])
    O11([Option 11\nDisabled Script Enforcement])
    Defender([Windows Defender\nAntivirus])
    AppIDSvc([AppID Service\nRequired dependency])

    O14 -->|"Shares EA mechanism\nbyte[4]=0x01 vs 0x00"| O13
    O14 -->|"In audit mode:\nfiles logged not blocked\nbased on ISG verdict"| O3
    O14 -->|"Unsigned policy risk:\nattacker could disable\nor modify ISG enforcement"| O6
    O14 -->|"ISG can evaluate scripts\nif script enforcement\nis active"| O11
    O14 -->|"Uses Defender's reputation\ninfrastructure internally"| Defender
    O14 -->|"Service must be running"| AppIDSvc

    style O14 fill:#1c1c2e,color:#a5b4fc
    style O13 fill:#0d1f12,color:#86efac
    style O3 fill:#1a1a0d,color:#fde68a
    style O6 fill:#1f0d0d,color:#fca5a5
    style O11 fill:#162032,color:#58a6ff
    style Defender fill:#0d1f12,color:#86efac
    style AppIDSvc fill:#162032,color:#58a6ff

flowchart TD
    Start([Evaluating Option 14]) --> Q1{Do you have\ncloud connectivity\non managed endpoints?}
    Q1 -- No --> NoCloud([ISG requires internet\nDo not enable Option 14\nConsider MI + catalog signing])
    Q1 -- Yes --> Q2{Does your environment\nhave significant\npre-existing software\nnot yet covered by policy?}
    Q2 -- Yes --> Q3{Is this primarily\ncommercial/well-known\nsoftware?}
    Q2 -- No --> Q4{Is your policy\nproperly signed?}
    Q3 -- Yes --> Q4
    Q3 -- No --> Internal([Internal software won't\nget ISG verdicts.\nUse explicit rules instead])
    Q4 -- Yes --> Enable([Enable Option 14\nHigh confidence])
    Q4 -- No --> Q5{Can you sign\nthe policy now?}
    Q5 -- Yes --> SignFirst([Sign policy first\nthen enable Option 14])
    Q5 -- No --> Caution([Enable Option 14 with caution\nDocument risk, plan to sign policy])

    style Start fill:#162032,color:#58a6ff
    style Q1 fill:#1a1a0d,color:#fde68a
    style Q2 fill:#1a1a0d,color:#fde68a
    style Q3 fill:#1a1a0d,color:#fde68a
    style Q4 fill:#1a1a0d,color:#fde68a
    style Q5 fill:#1a1a0d,color:#fde68a
    style NoCloud fill:#1f0d0d,color:#fca5a5
    style Enable fill:#0d1f12,color:#86efac
    style Internal fill:#1c1c2e,color:#a5b4fc
    style SignFirst fill:#1a1a0d,color:#fde68a
    style Caution fill:#1a1a0d,color:#fde68a

sequenceDiagram
    actor Admin as Security Team
    participant MDM as Intune
    participant Endpoint as Employee Laptop
    participant CI as ci.dll
    participant ISGClient as ISG Client (appidtel)
    participant ISGCloud as ISG Cloud\n(sp.oci.microsoft.com)
    participant NTFS as NTFS File System
    participant SIEM as SIEM / Sentinel

    Admin->>MDM: Deploy App Control policy:\n- Windows signer rules (base)\n- Option 13 (MI)\n- Option 14 (ISG)\n- Option 3 (Audit mode initially)

    MDM->>Endpoint: Policy deployed in AUDIT mode
    Note over Endpoint: Audit period: 2 weeks

    Endpoint->>CI: User opens Zoom.exe
    CI->>CI: No explicit Zoom signer rule in policy
    CI->>CI: Option 14 enabled: check ISG
    CI->>ISGClient: Request ISG for Zoom.exe SHA256
    ISGClient->>ISGCloud: POST reputation request\n{hash: abc123..., file: "Zoom.exe",\npublisher: "Zoom Video Communications"}
    ISGCloud-->>ISGClient: Verdict: Known Good\n(prevalence: 400M+ machines)
    ISGClient->>NTFS: Write KERNEL.SMARTLOCKER.ORIGINCLAIM\nbyte[4]=0x01 (ISG authorized)
    ISGClient-->>CI: Verdict: Known Good
    CI->>CI: Audit mode: log authorization event
    Note over Endpoint: Zoom runs; event 3086 logged

    Endpoint->>CI: User opens InternalCRM.exe\n(custom-built internal app)
    CI->>CI: No explicit rule for InternalCRM.exe
    CI->>ISGClient: Request ISG reputation
    ISGClient->>ISGCloud: POST reputation request\n{hash: xyz789..., file: "InternalCRM.exe"}
    ISGCloud-->>ISGClient: Verdict: Unknown\n(hash never seen globally — internal app)
    ISGClient-->>CI: Verdict: Unknown
    CI->>CI: Audit mode: log BLOCK event (would block in enforcement)
    CI->>SIEM: Event 3076: InternalCRM.exe would be blocked

    Admin->>SIEM: Review audit events after 2 weeks
    Admin->>Admin: Identify InternalCRM.exe as legitimate internal app
    Admin->>MDM: Add signer rule for internal code-signing cert
    Admin->>MDM: Add catalog hash for InternalCRM.exe
    Admin->>MDM: Remove Option 3 (switch from Audit to Enforce)
    MDM->>Endpoint: Updated enforcement policy

    Note over Endpoint: Now in ENFORCEMENT mode
    Endpoint->>CI: User opens Zoom.exe
    CI->>CI: No explicit Zoom rule
    CI->>NTFS: Check EA cache
    NTFS-->>CI: EA present, byte[4]=0x01, not expired
    CI-->>Endpoint: Zoom allowed (cached ISG verdict)
    Note over Endpoint: No cloud round-trip needed — local cache hit

    Endpoint->>CI: User attempts to run suspicious_tool.exe\n(downloaded from internet)
    CI->>CI: No explicit rule
    CI->>ISGClient: Request ISG reputation
    ISGClient->>ISGCloud: POST reputation request
    ISGCloud-->>ISGClient: Verdict: Unknown\n(new file, limited distribution)
    ISGClient-->>CI: Verdict: Unknown
    CI-->>Endpoint: BLOCKED (enforcement mode + unknown ISG verdict)
    CI->>SIEM: Event 3077: suspicious_tool.exe blocked
    SIEM->>Admin: Alert: blocked file on endpoint

flowchart TD
    subgraph OnlineFlow["Online Behavior"]
        O1([File execution]) --> O2{EA cache\nvalid?}
        O2 -- Yes --> O3([Allow — no cloud trip])
        O2 -- No --> O4[Query ISG cloud]
        O4 --> O5{Verdict?}
        O5 -- Known Good --> O6([Allow + refresh EA cache])
        O5 -- Other --> O7([Block])
    end

    subgraph OfflineFlow["Offline Behavior"]
        F1([File execution]) --> F2{EA cache\nvalid?}
        F2 -- Yes --> F3([Allow — cached verdict])
        F2 -- No --> F4[Query ISG cloud]
        F4 -->|Network unreachable| F5([BLOCK — no verdict available])
    end

    style O1 fill:#162032,color:#58a6ff
    style O2 fill:#1a1a0d,color:#fde68a
    style O3 fill:#0d1f12,color:#86efac
    style O4 fill:#1c1c2e,color:#a5b4fc
    style O5 fill:#1a1a0d,color:#fde68a
    style O6 fill:#0d1f12,color:#86efac
    style O7 fill:#1f0d0d,color:#fca5a5
    style F1 fill:#162032,color:#58a6ff
    style F2 fill:#1a1a0d,color:#fde68a
    style F3 fill:#0d1f12,color:#86efac
    style F4 fill:#1c1c2e,color:#a5b4fc
    style F5 fill:#1f0d0d,color:#fca5a5