{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3omicrosoftwindows_101909/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:-:*:*:*","cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:rt:*:*:*","cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server:2022:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.4,"id":"CVE-2022-21894"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Splunk Enterprise","Splunk Enterprise Security","Splunk Cloud"],"_cs_severities":["high"],"_cs_tags":["defense-evasion","registry-modification","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Splunk"],"content_html":"\u003cp\u003eThis threat brief focuses on the disabling of Hypervisor-protected Code Integrity (HVCI) on Windows systems. HVCI is a critical security feature that protects the kernel and system processes from tampering by malicious code. Attackers may disable HVCI to bypass security controls and execute unsigned kernel-mode code, leading to kernel-level rootkits or other severe security breaches. This activity is detected by monitoring changes to specific Windows registry keys related to HVCI configuration using Sysmon Event ID 13. The activity is associated with the BlackLotus Campaign, which exploits CVE-2022-21894.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the system (e.g., via phishing or exploiting a vulnerability).\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges to gain administrative access, required to modify system-level registry settings.\u003c/li\u003e\n\u003cli\u003eThe attacker uses a script or executable to modify the registry.\u003c/li\u003e\n\u003cli\u003eThe script modifies the registry key \u003ccode\u003eHKLM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled\u003c/code\u003e to a value of \u003ccode\u003e0x00000000\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe system restarts, and HVCI is disabled.\u003c/li\u003e\n\u003cli\u003eThe attacker deploys and executes unsigned kernel-mode code or a rootkit.\u003c/li\u003e\n\u003cli\u003eThe malicious code gains persistent control of the system at the kernel level.\u003c/li\u003e\n\u003cli\u003eThe attacker performs further malicious activities, such as data theft or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful disabling of HVCI can lead to a complete compromise of the affected system. Attackers can install kernel-level rootkits, bypass security controls, and execute arbitrary code in the kernel. This can lead to data theft, system instability, and further propagation of malware within the network. The BlackLotus campaign exploits this type of vulnerability to establish persistent, low-level control over compromised systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon Event ID 13 logging to capture registry modification events.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect HVCI Disable via Registry\u003c/code\u003e to your SIEM to detect HVCI being disabled.\u003c/li\u003e\n\u003cli\u003eInvestigate any detected instances of HVCI being disabled, as this can be a sign of malicious activity.\u003c/li\u003e\n\u003cli\u003eEnsure systems are patched against CVE-2022-21894 to prevent exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor for suspicious processes modifying the registry keys related to HVCI.\u003c/li\u003e\n\u003cli\u003eTune the Sigma rule \u003ccode\u003eDetect HVCI Disable via Registry\u003c/code\u003e to filter out legitimate administrative scripts, if necessary.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T20:48:23Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-disable-hvci/","summary":"Detection of Hypervisor-protected Code Integrity (HVCI) being disabled by modifying specific Windows registry keys, potentially allowing the execution of malicious kernel-mode code.","title":"Windows HVCI Disabled via Registry Modification","url":"https://feed.craftedsignal.io/briefs/2024-01-disable-hvci/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}