Attempt to Disable Driver via HVCIDisallowedImages

[rule]
description = """
Identifies registry modification to disallow a driver by name using the undocumented Code Integrity registry value
HVCIDisallowedImages. An adversary may abuse this setting to block Endpoint security drivers from loading after system
reboot.
"""
id = "908bec9a-39c6-4de4-b8e5-25f0b57faa38"
license = "Elastic License v2"
name = "Attempt to Disable Driver via HVCIDisallowedImages"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/device-guard-and-credential-guard",
    "https://github.com/yardenshafir/conference_talks/blob/main/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf",
]
version = "1.0.11"

query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\*HVCIDisallowedImages*"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"