{
	"Hyper-V HKLM Registry Keys": {
		"description": "Check if `HKLM\\SOFTWARE\\Microsoft\\Hyper-V' or `HKLM\\SOFTWARE\\Microsoft\\VirtualMachine' Registry Keys are present.",
		"countermeasures": "Remove `HKLM\\SOFTWARE\\Microsoft\\Hyper-V' and `HKLM\\SOFTWARE\\Microsoft\\VirtualMachine' Registry Keys.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"SOFTWARE\\Microsoft\\Hyper-V",
				"SOFTWARE\\Microsoft\\VirtualMachine"
			]
		},
		"score": 10
	},
	"Hyper-V Services Registry Keys": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\vmic*' Registry Keys are present.",
		"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\vmic*' Registry Keys.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"SYSTEM\\ControlSet001\\Services\\vmicheartbeat",
				"SYSTEM\\ControlSet001\\Services\\vmicvss",
				"SYSTEM\\ControlSet001\\Services\\vmicshutdown",
				"SYSTEM\\ControlSet001\\Services\\vmicexchange"
			]
		},
		"score": 8
	},
	"Hyper-V Directory Device Object": {
		"description": "Check if specific directory object `\\Device' contains the following object: `VmGenerationCounter'.",
		"countermeasures": "Stop specific service.",
		"type": "object",
		"enabled": "yes",
		"arguments": {
			"directory" : "\\Device",
			"name": "VmGenerationCounter"
		},
		"score": 7
	},
	"Hyper-V CPU HypervisorID": {
		"description": "Check if processor HypervisorID does not equal to: `Microsoft Hv'.",
		"countermeasures": "cpuid instruction mask.",
		"type": "cpuid_h",
		"enabled": "yes",
		"arguments": {
			"vendor": ["Microsoft Hv"]
		},
		"score": 10
	}
}