Add Rule: Driver Added To Disallowed Images In HVCI - Registry

[omaramin17]

Summary of the Pull Request

This PR add detection of modification to HVCIDisallowedImages to blocks loading drivers by filename according to this recent tweet

Changelog

new: Driver Added To Disallowed Images In HVCI - Registry

Example Log Event

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/>
    <EventID>13</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>13</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime='2024-08-12T10:51:58.6970127Z'/>
    <EventRecordID>134290435</EventRecordID>
    <Correlation/>
    <Execution ProcessID='6148' ThreadID='9200'/>
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
    <Computer>REDACTED</Computer>
    <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
    <Data Name='RuleName'>-</Data>
    <Data Name='EventType'>SetValue</Data>
    <Data Name='UtcTime'>2024-08-12 10:51:58.696</Data>
    <Data Name='ProcessGuid'>{f3beb03c-e94e-66b9-013e-000000002501}</Data>
    <Data Name='ProcessId'>2380</Data>
    <Data Name='Image'>C:\Windows\system32\reg.exe</Data>
    <Data Name='TargetObject'>HKLM\System\CurrentControlSet\Control\CI\HvciDisallowedImages</Data>
    <Data Name='Details'>Binary Data</Data>
    <Data Name='User'>REDACTED</Data>
  </EventData>
</Event>

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

As this was already covered by some private rule last year, i'll migrate the internal version here to avoid duplication.