SBAT

• Secure Boot Advanced Targeting
• Generation-based revocations approach
• Much more efficient than DBX
• SbatLevel variable decides if things are allowed to run
• CSV data embedded in signed application binaries – see example