Defender Alert: Possible attempt to modify Code Integrity policy

[leifdavisson]

The file vbssipolicy.p7b is a Microsoft-signed revocation policy used in Windows environments to enhance the security of Virtualization-Based Security (VBS). It is part of Microsoft's efforts to prevent rollback attacks on VBS-related system files, ensuring that only updated and secure versions of these files are loaded during the boot process.

VbsSiPolicy.p7b

[rbalsleyMSFT]

Looks like it doesn't like what BCDBoot is doing (BCDBoot is responsible for copying in the files needed for the system partition of the VHDX file)

Did it block you, or did it continue? Looks like it's continued.