Query: write Sigma for Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex
Matching passage: Sigma rule: Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex. Logsource: windows / process_creation. Rule: title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine id: 6225c53a-a96e-4235-b28f-8d7997cd96eb related: - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a type: similar status: experimental description: 'Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms. ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_base: CommandLine|contains: \DeviceGuard selection_cli_key: CommandLine|contains: - EnableVirtualizationBasedSecurity - HypervisorEnforcedCodeIntegrity condition: all of selection_* falsepositives: - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml simulation: - type: atomic-red-team name: Disable Hypervisor-Enforced Code Integrity (HVCI) technique: T1562.001 atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
Near-miss passage: Sigma rule: Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused b. Logsource: windows / process_creation. Rule: title: Suspicious Calculator Usage id: 737e618a-a410-49b5-bec3-9e55ff7fbc15 status: test description: 'Detects suspicious use of ''calc.exe'' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion. ' references: - https://twitter.com/ItsReallyNick/status/1094080242686312448 author: Florian Roth (Nextron Systems) date: 2019-02-09 modified: 2023-11-09 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: '\calc.exe ' selection_2: Image|endswith: \calc.exe filter_main_known_locations: Image|contains: - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ condition: selection_1 or ( selection_2 and not filter_main_known_locations ) falsepositives: - Unknown level: high