Hypervisor Enforced Code Integrity Disabled

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•16

Detects changes to the HypervisorEnforcedCodeIntegrity registry key where the "Enabled" value is set to 0, which disables the Hypervisor Enforced Code Integrity (HVCI) feature. Disabling HVCI allows an attacker to load unsigned and untrusted code into the kernel, potentially facilitating privilege escalation or defense evasion.