Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

FreeUnreviewedSigmahighv1

windows-hvci-registry-tampering-via-reg-exe-or-powershell-command-line-6225c53a

title: Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line
id: a0fe4e52-015b-42ba-bf1e-13934a4237d4
related:
  - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a
    type: similar
  - id: 6225c53a-a96e-4235-b28f-8d7997cd96eb
    type: derived
status: experimental
description: This rule flags command-line activity from reg.exe or PowerShell/pwsh that modifies registry settings associated with Hypervisor-protected Code Integrity (HVCI), specifically values related to virtualization-based security and hypervisor enforced code integrity. Such tampering matters because altering HVCI-related registry configuration can weaken kernel code integrity protections, potentially enabling malicious or unsigned driver loading and defense evasion. The detection relies on process creation telemetry that includes the executable path/name and full command line contents referencing HVCI registry elements.
references:
  - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
  - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-26
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
        - reg.exe
  selection_cli:
    CommandLine|contains:
      - "add "
      - "New-ItemProperty "
      - "Set-ItemProperty "
      - "si "
  selection_cli_base:
    CommandLine|contains: \DeviceGuard
  selection_cli_key:
    CommandLine|contains:
      - EnableVirtualizationBasedSecurity
      - HypervisorEnforcedCodeIntegrity
  condition: all of selection_*
falsepositives:
  - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml
simulation:
  - type: atomic-red-team
    name: Disable Hypervisor-Enforced Code Integrity (HVCI)
    technique: T1562.001
    atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
license: DRL-1.1

What it detects

This rule flags command-line activity from reg.exe or PowerShell/pwsh that modifies registry settings associated with Hypervisor-protected Code Integrity (HVCI), specifically values related to virtualization-based security and hypervisor enforced code integrity. Such tampering matters because altering HVCI-related registry configuration can weaken kernel code integrity protections, potentially enabling malicious or unsigned driver loading and defense evasion. The detection relies on process creation telemetry that includes the executable path/name and full command line contents referencing HVCI registry elements.

Known false positives

Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.