Elastic Defend high stable eql
Attempt to Disable Driver via HVCIDisallowedImages
Identifies registry modification to disallow a driver by name using the undocumented Code Integrity registry value HVCIDisallowedImages. An adversary may abuse this setting to block Endpoint security drivers from loading after system reboot.
Detection Logic
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\*HVCIDisallowedImages*"Field Validations
Loading…
Comments (0)
Loading comments...