Potential ESC11 false positive when remote InterfaceFlags registry read fails

[demelostar]

Hello Team,
While reviewing the ESC11 detection logic in CertificateAuthorityEnterprise.cs, I noticed that a failed remote registry read may potentially be interpreted as RPC Request Encryption: Disabled.
In the code, the GetInterfaceFlags() retrieves InterfaceFlags using:

return (InterfaceFlags)GetRemoteRegistryKey<int>(
    $"SYSTEM\\CurrentControlSet\\Services\\CertSvc\\Configuration\\{Name}",
    "InterfaceFlags"
);

GetRemoteRegistryKey() catches exceptions and returns:

return default;

Because the caller uses GetRemoteRegistryKey(), default(int) is 0.

I think this means that a registry read failure can result in:

InterfaceFlags = 0

then the ESC11-related flag check then evaluates:

InterfaceFlags.ENFORCE_ENCRYPT_ICERTREQUEST // 0x00000200

against 0, which results in the flag being considered absent.

At the end we will have:

RpcRequestEncryption = Disabled

may represent either:

InterfaceFlags was successfully read and IF_ENFORCEENCRYPTICERTREQUEST was actually unset, or
the registry read failed and InterfaceFlags was never obtained.

Those two cases should probably not be treated as equivalent.

An inability to retrieve InterfaceFlags should therefore ideally result in an Unknown / CouldNotRead state rather than being interpreted as the flag being disabled.
Otherwise, a failed Remote Registry query could potentially generate an ESC11 false positive.

Maybe ESC11 evaluation could distinguish:
Enabled
Disabled
Unknown
Instead of mapping a read failure to Disabled.

For example:

var interfaceFlags = GetInterfaceFlags();

if (!interfaceFlags.HasValue)
{
    RpcRequestEncryption = "Unknown";
}
else
{
    RpcRequestEncryption =
        interfaceFlags.Value.HasFlag(
            InterfaceFlags.ENFORCE_ENCRYPT_ICERTREQUEST)
        ? "Enabled"
        : "Disabled";
}

ESC11 should only be reported based on this configuration check when the value was successfully retrieved and the flag is confirmed absent.

Thank you again for your work 😃