Option 15 — Enabled EAs on Reboot#

flowchart TD
    A([Binary Execution Request\nProcess or Script]) --> B{CI Kernel Driver\nci.dll}

    B --> C{Explicit Allow Rule?\nSigner / Hash / FilePath}
    C -- Yes --> Z1([✓ Allow Execution])
    C -- No --> D{Option 14 Active?\nISG Authorization Enabled}

    D -- No --> Z2([✗ Block Execution])
    D -- Yes --> E{Local EA Token\nPresent on File?}

    E -- Yes, EA found --> F{Option 15 Active?\nInvalidate EAs on Reboot}
    F -- No / EA still valid --> Z1
    F -- Yes / Reboot occurred --> G[EA Invalidated at Boot\nToken Cleared from File]
    G --> H[Query ISG Cloud\nMicrosoft Reputation Service]

    E -- No, no EA --> H

    H --> I{ISG Returns\nReputation Score}
    I -- Known Good / Trusted --> J[Stamp New EA on File\nCache Result Locally]
    J --> Z1
    I -- Unknown / Insufficient data --> Z2
    I -- Known Bad / Malicious --> Z2

    style A fill:#162032,color:#58a6ff
    style B fill:#1c1c2e,color:#a5b4fc
    style C fill:#162032,color:#58a6ff
    style D fill:#1a1a0d,color:#fde68a
    style E fill:#1a1a0d,color:#fde68a
    style F fill:#1f0d0d,color:#fca5a5
    style G fill:#1f0d0d,color:#fca5a5
    style H fill:#162032,color:#58a6ff
    style I fill:#1a1a0d,color:#fde68a
    style J fill:#0d1f12,color:#86efac
    style Z1 fill:#0d1f12,color:#86efac
    style Z2 fill:#1f0d0d,color:#fca5a5

flowchart LR
    subgraph REQUIRED ["Required Dependency"]
        O14["Option 14\nEnabled:Intelligent Security\nGraph Authorization"]
    end

    subgraph SUBJECT ["This Option"]
        O15["Option 15\nEnabled:Invalidate\nEAs on Reboot"]
    end

    subgraph COMPATIBLE ["Compatible / Complementary"]
        O3["Option 3\nEnabled:Audit Mode"]
        O16["Option 16\nEnabled:Update Policy\nNo Reboot"]
        O17["Option 17\nEnabled:Allow Supplemental\nPolicies"]
    end

    subgraph IRRELEVANT ["No Direct Relationship"]
        O0["Option 0\nEnabled:UMCI"]
        O1["Option 1\nEnabled:Boot Menu\nProtection"]
        O9["Option 9\nEnabled:Advanced\nBoot Options Menu"]
    end

    O14 -- "MUST be set before\nOption 15 has any effect" --> O15
    O15 -- "Works in Audit Mode\n(no block, but EAs still cleared)" --> O3
    O15 -- "Policy updates apply\nwithout reboot; EA\ninvalidation still occurs\non next actual reboot" --> O16
    O15 -- "Base policy setting only\nnot inherited by\nsupplementals" --> O17

    style O14 fill:#1a1a0d,color:#fde68a
    style O15 fill:#162032,color:#58a6ff
    style O3 fill:#0d1f12,color:#86efac
    style O16 fill:#0d1f12,color:#86efac
    style O17 fill:#0d1f12,color:#86efac
    style O0 fill:#1c1c2e,color:#a5b4fc
    style O1 fill:#1c1c2e,color:#a5b4fc
    style O9 fill:#1c1c2e,color:#a5b4fc

flowchart TD
    START([Is Option 14 ISG\nAuthorization Enabled?]) --> NO14{No}
    START --> YES14{Yes}

    NO14 --> STOP1([Option 15 has no effect.\nDo not enable. Enable\nOption 14 first if ISG\nis desired.])

    YES14 --> Q1{Is the environment\nhigh-security / regulated?\nGov / Finance / Healthcare?}
    Q1 -- Yes --> ENABLE([ENABLE Option 15\nForce re-validation every reboot\nMinimize dwell time\nPrevent stale trust])

    Q1 -- No --> Q2{Are endpoints frequently\noffline for extended\nperiods e.g. field devices\nair-gapped systems?}
    Q2 -- Yes --> DISABLE([CONSIDER DISABLING Option 15\nOffline devices may block\nlegitimate software if\nISG cannot be reached after reboot])

    Q2 -- No --> Q3{Is reputation revocation\na real threat in\nyour threat model?}
    Q3 -- Yes --> ENABLE
    Q3 -- No --> Q4{Performance concern?\nMany thousands of files\nauthorized by ISG?}
    Q4 -- Yes --> CONSIDER([EVALUATE: Disabling saves\nISG round-trips at startup\nbut accepts staleness risk])
    Q4 -- No --> ENABLE

    style START fill:#162032,color:#58a6ff
    style NO14 fill:#1f0d0d,color:#fca5a5
    style YES14 fill:#0d1f12,color:#86efac
    style Q1 fill:#1a1a0d,color:#fde68a
    style Q2 fill:#1a1a0d,color:#fde68a
    style Q3 fill:#1a1a0d,color:#fde68a
    style Q4 fill:#1a1a0d,color:#fde68a
    style ENABLE fill:#0d1f12,color:#86efac
    style DISABLE fill:#1f0d0d,color:#fca5a5
    style CONSIDER fill:#1c1c2e,color:#a5b4fc
    style STOP1 fill:#1f0d0d,color:#fca5a5

sequenceDiagram
    actor SecOps as Security Operations
    participant ISG as Microsoft ISG Cloud
    participant Endpoint as Windows Endpoint<br/>(ci.dll)
    participant File as DataSync.exe<br/>(on disk)
    participant Attacker as Threat Actor<br/>(initial compromise)

    Note over Attacker,File: Day 0 — Initial Execution
    Attacker ->> File: Delivers trojanized DataSync.exe
    Endpoint ->> ISG: Query reputation for DataSync.exe
    ISG -->> Endpoint: Reputation: KNOWN GOOD (not yet detected)
    Endpoint ->> File: Stamp EA token ($KERNEL.PURGE.ESBCACHE)
    Endpoint -->> Attacker: File allowed to execute ✓

    Note over SecOps,ISG: Day 3 — Threat Intelligence Update
    SecOps ->> ISG: Reports trojanized binary (telemetry / MSTIC)
    ISG -->> ISG: Revokes reputation for DataSync.exe hash
    Note over Endpoint: Option 15 NOT set scenario:<br/>EA token still on disk.<br/>File continues to run ✗

    Note over Endpoint,File: Day 4 — System Reboot (Option 15 IS set)
    Endpoint ->> File: Boot-time EA sweep (ci.dll initialization)
    Endpoint ->> File: Remove all ISG EA tokens
    Note over File: EA cleared. File no longer has cached authorization.

    Note over Attacker,Endpoint: Day 4 — Attacker tries to run DataSync.exe again
    Attacker ->> Endpoint: Attempt to execute DataSync.exe
    Endpoint ->> ISG: Re-query reputation (no local EA present)
    ISG -->> Endpoint: Reputation: KNOWN BAD (revoked)
    Endpoint -->> Attacker: BLOCK — execution denied ✗
    Endpoint ->> SecOps: Generate Code Integrity event 3077/3076

    Note over SecOps: Incident contained within one reboot cycle