Windows Registry: DisableHypervisorEnforcedPagingTranslation Set to 1

title: "Windows Registry: DisableHypervisorEnforcedPagingTranslation Set to 1"
id: dabd3151-dd6b-47c6-ac43-350dcd03ec89
status: test
description: This rule flags changes to the DisableHypervisorEnforcedPagingTranslation registry value when it is set to DWORD 0x00000001. Disabling hypervisor enforced paging translation can weaken a key platform security control, making it relevant for defense impairment. The detection relies on Windows registry-set telemetry capturing the value name and the DWORD data written by the actor.
references:
  - https://twitter.com/standa_t/status/1808868985678803222
  - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7f2954d2-99c2-4d42-a065-ca36740f187b
    type: derived