Driver Added To Disallowed Images In HVCI - Registry

calendar Aug 21, 2024 · attack.defense-evasion  ·
Share on: linkedin copy

Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.

Sigma rule (View on GitHub)

 1title: Driver Added To Disallowed Images In HVCI - Registry
 2id: 555155a2-03bf-4fe7-af74-d176b3fdbe16
 3related:
 4    - id: 44cee399-f6b1-45cc-a87c-ea14c6064d6b
 5      type: similar
 6status: experimental
 7description: |
 8        Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading.
 9references:
10    - https://github.com/yardenshafir/conference_talks/blob/3de1f5d7c02656c35117f067fbff0a219c304b09/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf
11    - https://x.com/yarden_shafir/status/1822667605175324787
12author: Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe)
13date: 2023-12-05
14modified: 2024-08-21
15tags:
16    - attack.defense-evasion
17logsource:
18    category: registry_set
19    product: windows
20detection:
21    selection:
22        TargetObject|contains|all:
23            - '\Control\CI\'
24            - '\HVCIDisallowedImages'
25    condition: selection
26falsepositives:
27    - Legitimate usage of this key would also trigger this. Investigate the driver being added and make sure its intended
28level: high

References

Related rules

to-top