Driver Added To Disallowed Images In HVCI Registry
Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading. This action is typically performed by adversaries to bypass Hypervisor-Protected Code Integrity (HVCI) and load unsigned or malicious drivers.
Sigma
