Windows Registry: HVCI disallowed image list modified (HVCIDisallowedImages)
Alerts when Windows HVCI disallowed images registry value is modified, indicating potential driver load policy tampering.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe) (SigmaHQ), DRL 1.1
- Published
- 2023-12-05
- Updated
- 2026-07-30
What it detects
This rule flags registry changes to the HVCI disallowed images list by matching updates to the HVCIDisallowedImages value under the Control\CI path. Attackers can use this mechanism to influence driver load behavior and potentially hinder security policy enforcement. Telemetry relies on Windows registry set events that include the target registry object path containing both Control\CI and HVCIDisallowedImages.
Reporting behind it
- github.comhttps://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf
- x.comhttps://x.com/yarden_shafir/status/1822667605175324787
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-hvci-disallowed-image-list-modified-hvcidisallowedimages-555155a2
title: "Windows Registry: HVCI disallowed image list modified (HVCIDisallowedImages)"
id: f259d04d-1842-49f0-9100-62cd02a937c0
related:
- id: 44cee399-f6b1-45cc-a87c-ea14c6064d6b
type: similar
- id: 555155a2-03bf-4fe7-af74-d176b3fdbe16
type: derived
status: test
description: This rule flags registry changes to the HVCI disallowed images list by matching updates to the HVCIDisallowedImages value under the Control\CI path. Attackers can use this mechanism to influence driver load behavior and potentially hinder security policy enforcement. Telemetry relies on Windows registry set events that include the target registry object path containing both Control\CI and HVCIDisallowedImages.
references:
- https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf
- https://x.com/yarden_shafir/status/1822667605175324787
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml
author: Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe), Huntrule Team
date: 2023-12-05
modified: 2024-08-21
tags:
- attack.stealth
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \Control\CI\
- \HVCIDisallowedImages
condition: selection
falsepositives:
- Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended
level: high
license: DRL-1.1