MT.1088: Devices with critical credentials should be protected by TPM.

ID	MT.1088
Severity	Medium
Suite	Mito
Product	Defender
Feature	Exposure Management
Security area	Devices and endpoints
Resource type	Device
User impact of fixing	Low
Effort to fix	Medium
MITRE ATT&CK	T1552.004
Reads from	Microsoft Graph

What this checks and how to fix it

Devices shown in the output are devices where a TPM (Trusted Platform Module) is not enabled, but contains credentials of critical accounts. When critical credentials are stored on devices without a TPM enabled, it is more easy for adversaries to steal those credentials when the device is compromised.

How to fix

Investigate the related devices and the steps that need to be taken in order to enable TPM support. This varies depending on operating system, hardware, and device. For more detailed results, you can manually run the following query in advanced hunting.

---

Mito check. Author: RobbeVandenDaele; contributors: SamErde. Open-source licences.