huntrule

Windows Process Command-Line Tampering of Credential Guard Registry Keys (DeviceGuard/LSA)

Alerts on PowerShell/Reg.exe commands that add/modify/delete DeviceGuard/LSA registry values tied to Credential Guard.

FreeUnreviewedSigmahighv1
title: Windows Process Command-Line Tampering of Credential Guard Registry Keys (DeviceGuard/LSA)
id: de15cc18-aa3c-4b3f-b7b1-625864bca596
related:
  - id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0
    type: similar
  - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff
    type: similar
  - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9
    type: derived
status: experimental
description: This rule flags process creation command lines that use PowerShell or Reg.exe to add, modify, or delete registry settings under DeviceGuard and LSA paths. It specifically looks for command lines referencing Credential Guard–related values such as EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, and LsaCfgFlags. Such activity is important because attackers may attempt to impair virtualization-based security to expose or access sensitive credential material. The detection relies on process creation telemetry with the process image/name and the full command line content used to manipulate the registry.
references:
  - https://woshub.com/disable-credential-guard-windows/
  - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-26
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
        - reg.exe
  selection_cli:
    CommandLine|contains:
      - "add "
      - "New-ItemProperty "
      - "Set-ItemProperty "
      - "si "
      - "delete "
      - "del "
      - "Remove-ItemProperty "
      - "rp "
  selection_key_base:
    CommandLine|contains:
      - \Control\DeviceGuard
      - \Control\LSA
      - Software\Policies\Microsoft\Windows\DeviceGuard
  selection_key_specific:
    CommandLine|contains:
      - EnableVirtualizationBasedSecurity
      - RequirePlatformSecurityFeatures
      - LsaCfgFlags
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/info.yml
license: DRL-1.1

What it detects

This rule flags process creation command lines that use PowerShell or Reg.exe to add, modify, or delete registry settings under DeviceGuard and LSA paths. It specifically looks for command lines referencing Credential Guard–related values such as EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, and LsaCfgFlags. Such activity is important because attackers may attempt to impair virtualization-based security to expose or access sensitive credential material. The detection relies on process creation telemetry with the process image/name and the full command line content used to manipulate the registry.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.