{"id":"8b7273a4-ba5d-4d8a-b04f-11f2900d043a","title":"Windows Hypervisor Enforced Code Integrity Disabled","description":"Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the \"Enabled\" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel\n","author":"Nasreddine Bencherchali (Nextron Systems), Anish Bogati","status":"test","level":"high","date":"2023-03-14","modified":"2024-07-05","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it."],"references":["https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/","https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci"],"source_path":"rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml","source_sha256":"7027cab8391fb22e83db07ba635e16f0580468b469d85814511a515e449e164d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Hypervisor Enforced Code Integrity Disabled\nid: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a\nrelated:\n    - id: 6225c53a-a96e-4235-b28f-8d7997cd96eb\n      type: similar\nstatus: test\ndescription: |\n    Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the \"Enabled\" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel\nreferences:\n    - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/\n    - https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci\nauthor: Nasreddine Bencherchali (Nextron Systems), Anish Bogati\ndate: 2023-03-14\nmodified: 2024-07-05\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith:\n            - '\\Control\\DeviceGuard\\HypervisorEnforcedCodeIntegrity'\n            - '\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled'\n            - '\\Microsoft\\Windows\\DeviceGuard\\HypervisorEnforcedCodeIntegrity'\n        Details: 'DWORD (0x00000000)'\n    condition: selection\nfalsepositives:\n    - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Disable Hypervisor-Enforced Code Integrity (HVCI)\n      technique: T1562.001\n      atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/8b7273a4-ba5d-4d8a-b04f-11f2900d043a.json","kind":"sigma"}