Hypervisor Enforced Paging Translation Disabled

Title: Hypervisor Enforced Paging Translation Disabled
Status: test
Description:Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.
References:
  -https://twitter.com/standa_t/status/1808868985678803222
  -https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-05
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\DisableHypervisorEnforcedPagingTranslation'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Unknown
Level: high