Query: Sigma rule for Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex
Matching passage: Sigma rule: Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex. Logsource: windows / process_creation. Rule: title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine id: 6225c53a-a96e-4235-b28f-8d7997cd96eb related: - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a type: similar status: experimental description: 'Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms. ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_base: CommandLine|contains: \DeviceGuard selection_cli_key: CommandLine|contains: - EnableVirtualizationBasedSecurity - HypervisorEnforcedCodeIntegrity condition: all of selection_* falsepositives: - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml simulation: - type: atomic-red-team name: Disable Hypervisor-Enforced Code Integrity (HVCI) technique: T1562.001 atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
Near-miss passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / ps_script. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell id: db885529-903f-4c5d-9864-28fe199e6370 related: - id: 435e10e4-992a-4281-96f3-38b11106adde type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADComputer ' - ' -Filter \*' ScriptBlockText|contains: - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium