Windows Registry: Hypervisor Enforced Code Integrity Enabled DWORD Set to 0
Alerts when HVCI-related registry values are set to 0, indicating Hypervisor Enforced Code Integrity has been disabled.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems), Anish Bogati (SigmaHQ), DRL 1.1
- Published
- 2023-03-14
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry modifications to HVCI-related Device Guard keys where the DWORD value is set to 0. Disabling Hypervisor Enforced Code Integrity weakens kernel code integrity protections and can enable execution of unsigned or untrusted code. It relies on registry set telemetry capturing the targeted key paths and the specific DWORD value change to 0.
Reporting behind it
- welivesecurity.comhttps://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Hypervisor Enforced Code Integrity Enabled DWORD Set to 0"
id: 1ef02c04-ab32-4a45-b255-95af0b1b3339
related:
- id: 6225c53a-a96e-4235-b28f-8d7997cd96eb
type: similar
- id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a
type: derived
status: test
description: This rule flags registry modifications to HVCI-related Device Guard keys where the DWORD value is set to 0. Disabling Hypervisor Enforced Code Integrity weakens kernel code integrity protections and can enable execution of unsigned or untrusted code. It relies on registry set telemetry capturing the targeted key paths and the specific DWORD value change to 0.
references:
- https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
- https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati, Huntrule Team
date: 2023-03-14
modified: 2024-07-05
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith:
- \Control\DeviceGuard\HypervisorEnforcedCodeIntegrity
- \Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled
- \Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/info.yml
simulation:
- type: atomic-red-team
name: Disable Hypervisor-Enforced Code Integrity (HVCI)
technique: T1562.001
atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
license: DRL-1.1