Detectionhightest

Windows Hypervisor Enforced Code Integrity Disabled

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems), Anish BogatiCreated Tue Mar 14Updated Fri Jul 058b7273a4-ba5d-4d8a-b04f-11f2900d043awindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|endswith:
            - '\Control\DeviceGuard\HypervisorEnforcedCodeIntegrity'
            - '\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled'
            - '\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity'
        Details: 'DWORD (0x00000000)'
    condition: selection

False Positives

Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.

References

Testing & Validation

Simulations

atomic-red-teamT1562.001

View on ART

Disable Hypervisor-Enforced Code Integrity (HVCI)

GUID: 70bd71e6-eba4-4e00-92f7-617911dbe020

Regression Tests

by SigmaHQ Team

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1562.001 · Disable or Modify Tools

Related Rules

SimilarDetectionhigh

Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

8b7273a4-ba5d-4d8a-b04f-11f2900d043a

Status

test

Level

high

Type

Detection

Created

Tue Mar 14

Modified

Fri Jul 05

Author

Nasreddine Bencherchali (Nextron Systems), Anish Bogati

Path

rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml

Raw Tags

attack.defense-evasionattack.t1562.001

View on GitHub