Query: detection rule: Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex
Matching passage: Sigma rule: Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex. Logsource: windows / process_creation. Rule: title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine id: 6225c53a-a96e-4235-b28f-8d7997cd96eb related: - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a type: similar status: experimental description: 'Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms. ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_base: CommandLine|contains: \DeviceGuard selection_cli_key: CommandLine|contains: - EnableVirtualizationBasedSecurity - HypervisorEnforcedCodeIntegrity condition: all of selection_* falsepositives: - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml simulation: - type: atomic-red-team name: Disable Hypervisor-Enforced Code Integrity (HVCI) technique: T1562.001 atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
Near-miss passage: Sigma rule: Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actor. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Logon Scripts - Registry id: 9ace0707-b560-49b8-b6ca-5148b42f39fb status: test description: Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2025-10-26 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence - attack.lateral-movement logsource: category: registry_set product: windows detection: selection: TargetObject|contains: UserInitMprLogonScript condition: selection falsepositives: - Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/info.yml simulation: - type: atomic-red-team name: Logon Scripts technique: T1037.001 atomic_guid: d6042746-07d4-4c92-9ad8-e644c114a231