Tamper-Protection Bypass × Elastic Agent

enrolling a new agent with the '--force' flag overwrites the existing agent without token validation

When Agent Tamper Protection is enabled, uninstalling the agent requires an uninstall token. However, enrolling a new agent with the '--force' flag overwrites the existing agent without token validation, because the agent does not validate policy signatures or check with Endpoint before proceeding. This bypasses the protection meant to prevent unauthorized agent replacement.

Monitor Elastic Agent logs for enrollment events with the '--force' flag or unexpected agent re-enrollment from the same host. Mitigation: Apply the vendor patch that validates policy signatures and requires token verification before forced enrollment.