0

Can Windows Defender detect changes to UEFI Secure Boot settings such as enabling, disabling, modify bootable device, modify boot OS, on an HP ProBook, and get the security log to the corporate IT incident managing office? How to enable this feature?

Also is Windows Defender able to detect if the PC was booted using a USB key?

Thank you all for the hints

Max

1 Answer 1

0

Microsoft Defender has the capability to scan UEFI, but does not appear to be configurable. It appears to have been added in 2020.

Any reporting would follow how endpoint logs are collected, which usually means the information is already configured to go to the SIEM.

It should be fairly easy to test disabling Secure Boot and check the logs/SIEM to see if an event is recorded.

https://learn.microsoft.com/en-us/defender-endpoint/uefi-scanning-in-defender-for-endpoint

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .