{"id":"6225c53a-a96e-4235-b28f-8d7997cd96eb","title":"Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine","description":"Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.\nHVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.\nAdversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-26","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it."],"references":["https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution","https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity"],"source_path":"rules/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml","source_sha256":"54edac8b46adf24038fcff0ac0edc2289249febe0620cf2149ac888b4e6ec839","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine\nid: 6225c53a-a96e-4235-b28f-8d7997cd96eb\nrelated:\n    - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.\n    HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.\n    Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.\nreferences:\n    - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution\n    - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-01-26\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\reg.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n              - 'reg.exe'\n    selection_cli:\n        CommandLine|contains:\n            - 'add '\n            - 'New-ItemProperty '\n            - 'Set-ItemProperty '\n            - 'si '  # SetItem Alias\n    selection_cli_base:\n        CommandLine|contains: '\\DeviceGuard'\n    selection_cli_key:\n        CommandLine|contains:\n            - 'EnableVirtualizationBasedSecurity'\n            - 'HypervisorEnforcedCodeIntegrity'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Disable Hypervisor-Enforced Code Integrity (HVCI)\n      technique: T1562.001\n      atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/6225c53a-a96e-4235-b28f-8d7997cd96eb.json","kind":"sigma"}