Windows Registry: Hypervisor Enforced Code Integrity Enabled DWORD Set to 0

Alerts when HVCI-related registry values are set to 0, indicating Hypervisor Enforced Code Integrity has been disabled.

FreeUnreviewedSigmahighv1

windows-registry-hypervisor-enforced-code-integrity-enabled-dword-set-to-0-8b7273a4

title: "Windows Registry: Hypervisor Enforced Code Integrity Enabled DWORD Set to 0"
id: 1ef02c04-ab32-4a45-b255-95af0b1b3339
related:
  - id: 6225c53a-a96e-4235-b28f-8d7997cd96eb
    type: similar
  - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a
    type: derived
status: test
description: This rule flags registry modifications to HVCI-related Device Guard keys where the DWORD value is set to 0. Disabling Hypervisor Enforced Code Integrity weakens kernel code integrity protections and can enable execution of unsigned or untrusted code. It relies on registry set telemetry capturing the targeted key paths and the specific DWORD value change to 0.
references:
  - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
  - https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati, Huntrule Team
date: 2023-03-14
modified: 2024-07-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \Control\DeviceGuard\HypervisorEnforcedCodeIntegrity
      - \Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled
      - \Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/info.yml
simulation:
  - type: atomic-red-team
    name: Disable Hypervisor-Enforced Code Integrity (HVCI)
    technique: T1562.001
    atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
license: DRL-1.1

What it detects

This rule flags registry modifications to HVCI-related Device Guard keys where the DWORD value is set to 0. Disabling Hypervisor Enforced Code Integrity weakens kernel code integrity protections and can enable execution of unsigned or untrusted code. It relies on registry set telemetry capturing the targeted key paths and the specific DWORD value change to 0.

Known false positives

Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.