From abe6402a5574a4e5fb79bc7f7e9f37da3c0a331e Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Mon, 25 Oct 2021 12:47:43 -0600 Subject: [PATCH] manipulate safe mode programs: restrict to windows --- .../bootloader/manipulate-safe-mode-programs.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/host-interaction/bootloader/manipulate-safe-mode-programs.yml b/host-interaction/bootloader/manipulate-safe-mode-programs.yml index 4b4f3bb9..7a76fdbb 100644 --- a/host-interaction/bootloader/manipulate-safe-mode-programs.yml +++ b/host-interaction/bootloader/manipulate-safe-mode-programs.yml @@ -9,8 +9,10 @@ rule: examples: - 3446b3889a52d81119d8c482a2a282b9:0x409AA8 features: - - or: - - substring: "Control\\SafeBoot\\Minimal\\" - description: registry key for safe mode, no networking - - substring: "Control\\SafeBoot\\Network\\" - description: registry key for safe mode, with networking + - and: + - os: windows + - or: + - substring: "Control\\SafeBoot\\Minimal\\" + description: registry key for safe mode, no networking + - substring: "Control\\SafeBoot\\Network\\" + description: registry key for safe mode, with networking