Hypervisor Enforced Code Integrity State Disabled

Rule Info

Name
Hypervisor Enforced Code Integrity State Disabled
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects when "Hypervisor Enforced Code Integrity" is disabled
Reference
https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement#identifying-memory-integrity-state
Date
2023-12-05 00:00:00
Modified
None
Id
ad16b792-e269-4a58-8cc2-7a67fc6ac6bb
Tags
attack.defense-evasion
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022