{
	"Xen Hardware Device Registry Keys": {
		"description": "Check if `HKLM\\HARDWARE\\ACPI\\*\\xen' Registry Keys are present.",
		"countermeasures": "Remove `HKLM\\HARDWARE\\ACPI\\*\\xen' Registry Keys.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"HARDWARE\\ACPI\\DSDT\\xen",
				"HARDWARE\\ACPI\\FADT\\xen",
				"HARDWARE\\ACPI\\RSDT\\xen"
			]
		},
		"score": 7
	},
	"Xen Services Registry Keys": {
		"description": "Check if `HKLM\\SYSTEM\\ControlSet001\\Services\\xen*' Registry Keys are present.",
		"countermeasures": "Remove `HKLM\\SYSTEM\\ControlSet001\\Services\\xen*' Registry Keys.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": [
				"SYSTEM\\ControlSet001\\Services\\xenevtchn",
				"SYSTEM\\ControlSet001\\Services\\xennet",
				"SYSTEM\\ControlSet001\\Services\\xennet6",
				"SYSTEM\\ControlSet001\\Services\\xensvc",
				"SYSTEM\\ControlSet001\\Services\\xenvdb"
			]
		},
		"score": 8
	},
	"Xen Processes": {
		"description": "Check if one of the following processes is running: `xenservice.exe', `xsvc_depriv.exe'",
		"countermeasures": "Exclude `xenservice.exe', `xsvc_depriv.exe' processes from enumeration or terminate them.",
		"type": "process",
		"enabled": "yes",
		"arguments": {
			"name": ["xenservice.exe", "xsvc_depriv.exe"]
		},
		"score": 10
	},
	"Xen CPU VendorID": {
		"description": "Check if processor VendorID does not equal to: `XenVMMXenVMM'.",
		"countermeasures": "cpuid instruction mask.",
		"type": "cpuid_v",
		"enabled": "yes",
		"arguments": {
			"vendor": ["XenVMMXenVMM"]
		},
		"score": 10
	},
	"Xen CPU HypervisorID": {
		"description": "Check if processor HypervisorID does not equal to: `XenVMMXenVMM'.",
		"countermeasures": "cpuid instruction mask.",
		"type": "cpuid_h",
		"enabled": "yes",
		"arguments": {
			"vendor": ["XenVMMXenVMM"]
		},
		"score": 10
	},
	"Xen DiskEnum Registry Key": {
		"description": "Check if `System\\CurrentControlSet\\Services\\Disk\\Enum' Registry Key has value `0'=`*xen*'.",
		"countermeasures": "Patch the registry to hide this indicator",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "contains",
			"hkey": "HKLM",
			"key": "System\\CurrentControlSet\\Services\\Disk\\Enum",
			"value_name": "0",
			"value_data": "xen"
		},
		"score": 7
	}
}