Hypervisor Enforced Paging Translation Disabled
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value where it is set to "1" to disable the Hypervisor Enforced Paging Translation feature. This action can be taken by adversaries to evade detection by security tools that rely on this feature for monitoring or integrity checks, potentially facilitating kernel exploits or rootkit installations.
Sigma
