Windows Registry: HVCI disallowed image list modified (HVCIDisallowedImages)

Alerts when Windows HVCI disallowed images registry value is modified, indicating potential driver load policy tampering.

FreeUnreviewedSigmahighv1

windows-registry-hvci-disallowed-image-list-modified-hvcidisallowedimages-555155a2

title: "Windows Registry: HVCI disallowed image list modified (HVCIDisallowedImages)"
id: f259d04d-1842-49f0-9100-62cd02a937c0
related:
  - id: 44cee399-f6b1-45cc-a87c-ea14c6064d6b
    type: similar
  - id: 555155a2-03bf-4fe7-af74-d176b3fdbe16
    type: derived
status: test
description: This rule flags registry changes to the HVCI disallowed images list by matching updates to the HVCIDisallowedImages value under the Control\CI path. Attackers can use this mechanism to influence driver load behavior and potentially hinder security policy enforcement. Telemetry relies on Windows registry set events that include the target registry object path containing both Control\CI and HVCIDisallowedImages.
references:
  - https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf
  - https://x.com/yarden_shafir/status/1822667605175324787
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml
author: Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe), Huntrule Team
date: 2023-12-05
modified: 2024-08-21
tags:
  - attack.stealth
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \Control\CI\
      - \HVCIDisallowedImages
  condition: selection
falsepositives:
  - Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended
level: high
license: DRL-1.1

What it detects

This rule flags registry changes to the HVCI disallowed images list by matching updates to the HVCIDisallowedImages value under the Control\CI path. Attackers can use this mechanism to influence driver load behavior and potentially hinder security policy enforcement. Telemetry relies on Windows registry set events that include the target registry object path containing both Control\CI and HVCIDisallowedImages.

Known false positives

Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.