Boot chain SBAT revocation metadata missing or outdated (shim,4/grub,5 mismatch)

Ethan Andrews@eandrews

•updated Jul 15, 2026•0•0•2

Detects when the Secure Boot Advanced Targeting (SBAT) registry policy on Windows systems is either missing or contains outdated revocation entries (lacking 'shim,4' and 'grub,5'). This indicates the boot chain may be using vulnerable bootloader components susceptible to known security bypasses, as the system is not properly enforcing updated revocation generation policies.