Sigma rule: Windows Credential Guard Registry Tampering Via CommandLine

Rule

Title

Windows Credential Guard Registry Tampering Via CommandLine

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-12-26

File

rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\reg.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
          - 'reg.exe'
selection_cli:
    CommandLine|contains:
        # add/modify
        - 'add '
        - 'New-ItemProperty '
        - 'Set-ItemProperty '
        - 'si '  # SetItem Alias
        # delete
        - 'delete '
        - 'del '
        - 'Remove-ItemProperty '
        - 'rp '
selection_key_base:
    CommandLine|contains:
        - '\Control\DeviceGuard'
        - '\Control\LSA'
        - 'Software\Policies\Microsoft\Windows\DeviceGuard'
selection_key_specific:
    CommandLine|contains:
        - 'EnableVirtualizationBasedSecurity'
        - 'RequirePlatformSecurityFeatures'
        - 'LsaCfgFlags'
condition: all of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

Related rules

• 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 (similar)
• d645ef86-2396-48a1-a2b6-b629ca3f57ff (similar)

References

• https://woshub.com/disable-credential-guard-windows/
• https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml