Add files via upload
This commit is contained in:
87owo authored and GitHub committed
1 parent
06e0e6a01c
commit
20d2f94146
1 file changed
+265
-144
+265
-144
@@ -1,5 +1,93 @@
|
||||
{
|
||||
"DynamicRules": [
|
||||
{
|
||||
"Name": "Process_Protect_Antivirus_Command",
|
||||
"Code": 1001,
|
||||
"Category": "Process",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskkill.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskmgr.exe",
|
||||
],
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"CommandLine": [
|
||||
"*taskkill*",
|
||||
"*PYAS.exe*",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
],
|
||||
"Target": [
|
||||
"*\\taskkill.exe",
|
||||
"*\\cmd.exe",
|
||||
"*\\powershell.exe",
|
||||
"*\\pwsh.exe",
|
||||
"*\\wmic.exe",
|
||||
"*\\net.exe",
|
||||
"*\\net1.exe",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Process_Protect_Antivirus_Handle",
|
||||
"Code": 1002,
|
||||
"Category": "Process",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\msedgewebview2.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\msedgewebview2.exe",
|
||||
],
|
||||
"Operations": [
|
||||
"Terminate",
|
||||
"SuspendResume",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Memory_Protect_Write",
|
||||
"Code": 1003,
|
||||
"Category": "Memory",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
|
||||
],
|
||||
"Operations": [
|
||||
"VmWrite",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Thread_Protect_Shellcode",
|
||||
"Code": 1004,
|
||||
"Category": "Thread",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
],
|
||||
"Operations": [
|
||||
"Execute",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_Antivirus",
|
||||
"Code": 2001,
|
||||
@@ -8,41 +96,44 @@
|
||||
"*\\PYAS.exe",
|
||||
"*\\unins000.exe",
|
||||
"*\\notepad*.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\PYAS.exe",
|
||||
"*\\ProgramData\\PYAS\\*.json",
|
||||
"*\\Engine\\Pattern\\*.onnx",
|
||||
"*\\Engine\\Properties\\*.onnx",
|
||||
"*\\Plugins\\Filter\\PYAS_Driver.sys",
|
||||
"*\\Plugins\\Rules\\*.json",
|
||||
"*\\Plugins\\Rules\\*.json",
|
||||
],
|
||||
"Operations": ["Write", "Delete"]
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_System",
|
||||
"Code": 2002,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\PYAS.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\sysclean.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\bootmgr",
|
||||
"\\Device\\HarddiskVolume*\\boot.ini",
|
||||
"\\Device\\HarddiskVolume*\\boot.ini",
|
||||
"\\Device\\HarddiskVolume*\\BOOTNXT",
|
||||
"\\Device\\HarddiskVolume*\\EFI\\*",
|
||||
"\\Device\\HarddiskVolume*\\EFI\\*",
|
||||
"\\Device\\HarddiskVolume*\\Boot\\*",
|
||||
"\\Device\\HarddiskVolume*\\Recovery\\*",
|
||||
"\\Device\\HarddiskVolume*\\Recovery\\*",
|
||||
"\\Device\\HarddiskVolume*\\System Volume Information\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\config\\*",
|
||||
],
|
||||
@@ -52,61 +143,71 @@
|
||||
"\\Device\\HarddiskVolume*\\System Volume Information\\SystemRestore\\FRStaging",
|
||||
"\\Device\\HarddiskVolume*\\System Volume Information\\IndexerVolumeGuid",
|
||||
],
|
||||
"Operations": ["Write", "Delete"]
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_System_Exploit",
|
||||
"Code": 2003,
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"*\\PYAS.exe",
|
||||
"*\\PYAS.exe",
|
||||
],
|
||||
"Target": [
|
||||
"*\\CON",
|
||||
"*\\CON",
|
||||
"*\\CON\\*",
|
||||
"*\\PRN",
|
||||
"*\\PRN",
|
||||
"*\\PRN\\*",
|
||||
"*\\AUX",
|
||||
"*\\AUX\\*",
|
||||
"*\\NUL",
|
||||
"*\\NUL\\*",
|
||||
"*\\NUL\\*",
|
||||
"*\\COM?",
|
||||
"*\\COM?\\*",
|
||||
"*\\LPT?",
|
||||
"*\\LPT?\\*",
|
||||
"*\\LPT?\\*",
|
||||
"*\\OSDATA",
|
||||
"*\\OSDATA\\*",
|
||||
"*\\OSDATA\\*",
|
||||
"*\\*<*",
|
||||
"*\\*>*",
|
||||
],
|
||||
"Operations": ["Create", "Write", "Rename"]
|
||||
"Operations": [
|
||||
"Create",
|
||||
"Write",
|
||||
"Rename",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_System_Ransom",
|
||||
"Code": 2004,
|
||||
"Category": "File",
|
||||
"Initiator": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*"
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\Logs\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*",
|
||||
],
|
||||
"Operations": [
|
||||
"Delete",
|
||||
"Rename",
|
||||
],
|
||||
"Operations": ["Delete", "Rename"],
|
||||
"Threshold": 50,
|
||||
"TimeWindow": 5000
|
||||
"TimeWindow": 5000,
|
||||
},
|
||||
{
|
||||
"Name": "File_Protect_Ransom",
|
||||
@@ -114,78 +215,103 @@
|
||||
"Category": "File",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"*\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe",
|
||||
"*\\Microsoft\\Edge*\\Install\\*\\setup.exe",
|
||||
"*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe",
|
||||
"*\\Mozilla Firefox\\firefox.exe",
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
"*\\Steam\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\Steam\\steamapps\\common\\*",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\PC4399_WPFLauncher.exe",
|
||||
"*\\Neverness To Everness\\NTELauncher.exe",
|
||||
|
||||
"*\\Neverness To Everness\\NTELauncher.exe",
|
||||
"*\\ThunderEv.exe",
|
||||
"*\\ThunderStart.exe",
|
||||
"*\\bin\\APlayer.exe",
|
||||
"*\\bilibili\\bilibili.exe",
|
||||
"*\\KuGou.exe",
|
||||
"*\\bin\\APlayer.exe",
|
||||
"*\\bilibili\\bilibili.exe",
|
||||
"*\\KuGou.exe",
|
||||
"*\\XLGame.exe",
|
||||
"*\\XLLiveUD.exe",
|
||||
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\XLLiveUD.exe",
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
|
||||
"*\\WPS Office\\ksolaunch.exe",
|
||||
"*\\WPS Office\\*\\wps.exe",
|
||||
|
||||
"*\\WPS Office\\*\\wps.exe",
|
||||
"*\\Application\\AndrowsLauncher.exe",
|
||||
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
||||
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
||||
"*\\bin\\*\\codex.exe",
|
||||
"*\\bin\\codex.exe",
|
||||
"*\\bin\\codex.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\Device\\HarddiskVolume*\\Users\\*"
|
||||
"\\Device\\HarddiskVolume*\\Users\\*",
|
||||
],
|
||||
"TargetExclude": [
|
||||
"*\\Documents\\My Games\\*",
|
||||
"*\\Documents\\My Games\\*",
|
||||
"*\\Documents\\Tencent Files\\*",
|
||||
"*\\Documents\\WeChat Files\\*",
|
||||
"*\\Documents\\WPS Cloud Files\\*",
|
||||
|
||||
"*\\Documents\\WeChat Files\\*",
|
||||
"*\\Documents\\WPS Cloud Files\\*",
|
||||
"*\\Users\\*\\steam\\*",
|
||||
"*\\User Data\\*",
|
||||
"*\\AppData\\*",
|
||||
"*\\AppData\\Local\\*",
|
||||
|
||||
"*\\Temp\\*",
|
||||
"*\\Local\\Temp\\*",
|
||||
"*\\cache\\*",
|
||||
|
||||
"*\\ventoy\\Boot\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*",
|
||||
"\\Device\\HarddiskVolume*\\Users\\*\\cache\\*",
|
||||
"*\\ventoy\\Boot\\*",
|
||||
"*\\AdminRegionConfig.*",
|
||||
"*\\nt_qq\\nt_*\\*",
|
||||
],
|
||||
"Extensions": [
|
||||
".zip", ".7z", ".rar", ".tar", ".gz",
|
||||
".ppt", ".pptx", ".wps", ".txt", ".rtf",
|
||||
".pdf", ".xls", ".xlsx", ".doc", ".docx",
|
||||
".jpg", ".jpeg", ".png", ".webp", ".gif",
|
||||
".mp3", ".wav", ".aac", ".ogg", ".flac",
|
||||
".mp4", ".avi", ".mov", ".wmv", ".mkv",
|
||||
".apk", ".jar", ".class", ".db", ".sqlite",
|
||||
".zip",
|
||||
".7z",
|
||||
".rar",
|
||||
".tar",
|
||||
".gz",
|
||||
".ppt",
|
||||
".pptx",
|
||||
".wps",
|
||||
".txt",
|
||||
".rtf",
|
||||
".pdf",
|
||||
".xls",
|
||||
".xlsx",
|
||||
".doc",
|
||||
".docx",
|
||||
".jpg",
|
||||
".jpeg",
|
||||
".png",
|
||||
".webp",
|
||||
".gif",
|
||||
".mp3",
|
||||
".wav",
|
||||
".aac",
|
||||
".ogg",
|
||||
".flac",
|
||||
".mp4",
|
||||
".avi",
|
||||
".mov",
|
||||
".wmv",
|
||||
".mkv",
|
||||
".apk",
|
||||
".jar",
|
||||
".class",
|
||||
".db",
|
||||
".sqlite",
|
||||
],
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Rename",
|
||||
],
|
||||
"Operations": ["Write", "Delete", "Rename"],
|
||||
"Threshold": 5,
|
||||
"TimeWindow": 3000
|
||||
"TimeWindow": 3000,
|
||||
},
|
||||
{
|
||||
"Name": "Device_Protect_Disk_Wiper",
|
||||
@@ -195,14 +321,15 @@
|
||||
"*\\PYAS.exe",
|
||||
"*\\rufus-*.exe",
|
||||
"*\\DiskInfo*.exe",
|
||||
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe",
|
||||
"\\Device\\HarddiskVolume*\\Windows\\System32\\format.com",
|
||||
],
|
||||
"Operations": ["Ioctl"]
|
||||
"Operations": [
|
||||
"Ioctl",
|
||||
]
|
||||
},
|
||||
{
|
||||
"Name": "Registry_Protect_System",
|
||||
@@ -210,146 +337,140 @@
|
||||
"Category": "Registry",
|
||||
"InitiatorExclude": [
|
||||
"\\Device\\HarddiskVolume*\\Windows\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files\\*",
|
||||
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
|
||||
"\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
|
||||
"*\\Google\\Chrome\\Application\\chrome.exe",
|
||||
"*\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"*\\Mozilla Firefox\\firefox.exe",
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
|
||||
"*\\Mozilla Firefox\\firefox.exe",
|
||||
"*\\Thorium\\Application\\thorium.exe",
|
||||
"*\\Sources\\SetupHost.exe",
|
||||
"*\\Work\\*\\DismHost.exe",
|
||||
|
||||
"*\\Steam\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\steam\\*\\steam.exe",
|
||||
"*\\Steam\\steamapps\\common\\*",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\Battle.net\\*\\Battle.net.exe",
|
||||
"*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe",
|
||||
"*\\PC4399_WPFLauncher.exe",
|
||||
"*\\Neverness To Everness\\NTELauncher.exe",
|
||||
|
||||
"*\\ThunderEv.exe",
|
||||
"*\\Neverness To Everness\\NTELauncher.exe",
|
||||
"*\\ThunderEv.exe",
|
||||
"*\\ThunderStart.exe",
|
||||
"*\\bin\\APlayer.exe",
|
||||
"*\\bilibili\\bilibili.exe",
|
||||
"*\\KuGou.exe",
|
||||
"*\\bilibili\\bilibili.exe",
|
||||
"*\\KuGou.exe",
|
||||
"*\\XLGame.exe",
|
||||
"*\\XLLiveUD.exe",
|
||||
|
||||
"*\\XLLiveUD.exe",
|
||||
"*\\hrkill-*.exe",
|
||||
"*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\360Safe.exe",
|
||||
"*\\PYAS.exe",
|
||||
|
||||
"*\\WPS Office\\ksolaunch.exe",
|
||||
"*\\WPS Office\\ksolaunch.exe",
|
||||
"*\\WPS Office\\*\\wps.exe",
|
||||
"*\\WPS Office\\*\\*.exe",
|
||||
|
||||
"*\\WPS Office\\*\\*.exe",
|
||||
"*\\Application\\AndrowsLauncher.exe",
|
||||
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
||||
"*\\bin\\*\\codex.exe",
|
||||
"*\\bin\\codex.exe",
|
||||
"*\\resources\\bin\\SDK\\DownloadSDKServer.exe",
|
||||
"*\\bin\\*\\codex.exe",
|
||||
"*\\bin\\codex.exe",
|
||||
],
|
||||
"Target": [
|
||||
"\\REGISTRY\\MACHINE\\BCD00000000",
|
||||
"\\REGISTRY\\MACHINE\\BCD00000000\\*",
|
||||
|
||||
"*\\Classes\\.exe",
|
||||
"*\\Classes\\.bat",
|
||||
"*\\Classes\\.cmd",
|
||||
"*\\Classes\\.bat",
|
||||
"*\\Classes\\.cmd",
|
||||
"*\\Classes\\.com",
|
||||
|
||||
"*\\Classes\\exefile\\*",
|
||||
"*\\Classes\\batfile\\*",
|
||||
"*\\Classes\\batfile\\*",
|
||||
"*\\Classes\\cmdfile\\*",
|
||||
"*\\Classes\\comfile\\*",
|
||||
|
||||
"*\\Classes\\comfile\\*",
|
||||
"*\\mouclass",
|
||||
"*\\kbdclass",
|
||||
"*\\kbdclass",
|
||||
"*\\DisableAntiSpyware",
|
||||
"*\\DisableWindowsUpdateAccess",
|
||||
"*\\DisableWindowsUpdateAccess",
|
||||
"*\\EnableLUA",
|
||||
"*\\ConsentPromptBehaviorAdmin",
|
||||
"*\\ConsentPromptBehaviorAdmin",
|
||||
"*\\NoControlPanel",
|
||||
"*\\NoDrives",
|
||||
"*\\NoFileMenu",
|
||||
"*\\NoFind",
|
||||
"*\\NoStartMenuPinnedList",
|
||||
"*\\NoFileMenu",
|
||||
"*\\NoFind",
|
||||
"*\\NoStartMenuPinnedList",
|
||||
"*\\NoSetFolders",
|
||||
"*\\NoSetFolderOptions",
|
||||
"*\\NoViewOnDrive",
|
||||
"*\\NoClose",
|
||||
"*\\NoDesktop",
|
||||
"*\\NoLogoff",
|
||||
"*\\NoViewOnDrive",
|
||||
"*\\NoClose",
|
||||
"*\\NoDesktop",
|
||||
"*\\NoLogoff",
|
||||
"*\\NoFolderOptions",
|
||||
"*\\RestrictRun",
|
||||
"*\\NoViewContextMenu",
|
||||
"*\\HideClock",
|
||||
"*\\HideClock",
|
||||
"*\\NoStartMenuMyGames",
|
||||
"*\\NoStartMenuMyMusic",
|
||||
"*\\DisableCMD",
|
||||
"*\\NoAddingComponents",
|
||||
"*\\NoAddingComponents",
|
||||
"*\\NoWinKeys",
|
||||
"*\\NoStartMenuLogOff",
|
||||
"*\\NoSimpleNetIDList",
|
||||
"*\\NoLowDiskSpaceChecks",
|
||||
"*\\NoLowDiskSpaceChecks",
|
||||
"*\\DisableLockWorkstation",
|
||||
"*\\Restrict_Run",
|
||||
"*\\DisableTaskMgr",
|
||||
"*\\DisableRegistryTools",
|
||||
"*\\DisableChangePassword",
|
||||
"*\\NoComponents",
|
||||
"*\\DisableRegistryTools",
|
||||
"*\\DisableChangePassword",
|
||||
"*\\NoComponents",
|
||||
"*\\NoStartMenuMorePrograms",
|
||||
"*\\NoActiveDesktop",
|
||||
"*\\NoActiveDesktop",
|
||||
"*\\NoSetActiveDesktop",
|
||||
"*\\NoRecentDocsMenu",
|
||||
"*\\NoWindowsUpdate",
|
||||
"*\\NoChangeStartMenu",
|
||||
"*\\NoChangeStartMenu",
|
||||
"*\\NoFavoritesMenu",
|
||||
"*\\NoRecentDocsHistory",
|
||||
"*\\NoSetTaskbar",
|
||||
"*\\NoSMHelp",
|
||||
"*\\NoSMHelp",
|
||||
"*\\NoTrayContextMenu",
|
||||
"*\\NoManageMyComputerVerb",
|
||||
"*\\NoRealMode",
|
||||
"*\\NoRun",
|
||||
"*\\NoRun",
|
||||
"*\\ClearRecentDocsOnExit",
|
||||
"*\\NoActiveDesktopChanges",
|
||||
"*\\NoStartMenuNetworkPlaces",
|
||||
"*\\NoActiveDesktopChanges",
|
||||
"*\\NoStartMenuNetworkPlaces",
|
||||
"*\\NoLockScreen",
|
||||
"*\\HideFastUserSwitching",
|
||||
"*\\ConsentPromptBehaviorUser",
|
||||
"*\\EnableSecureUIAPaths",
|
||||
"*\\NoSRM",
|
||||
"*\\ConsentPromptBehaviorUser",
|
||||
"*\\EnableSecureUIAPaths",
|
||||
"*\\NoSRM",
|
||||
"*\\NoInteractiveServices",
|
||||
"*\\ShutdownWithoutLogon",
|
||||
"*\\ShutdownWithoutLogon",
|
||||
"*\\AutoAdminLogon",
|
||||
"*\\BootExecute",
|
||||
"*\\SubSystems",
|
||||
"*\\FirmwareBootDevice",
|
||||
"*\\FirmwareBootDevice",
|
||||
"*\\BootDriverFlags",
|
||||
"*\\SystemStartOptions",
|
||||
"*\\DisableAutomaticRestartOnFailure",
|
||||
"*\\SystemStartOptions",
|
||||
"*\\DisableAutomaticRestartOnFailure",
|
||||
"*\\SystemBiosVersion",
|
||||
"*\\NoTheme",
|
||||
"*\\SystemSetupInProgress",
|
||||
"*\\SetupType",
|
||||
"*\\SetupType",
|
||||
"*\\AutoReboot",
|
||||
"*\\Userinit",
|
||||
"*\\UIHost",
|
||||
"*\\Userinit",
|
||||
"*\\UIHost",
|
||||
"*\\Debugger",
|
||||
"*\\DefaultUserName",
|
||||
"*\\DefaultUserName",
|
||||
"*\\DefaultPassword",
|
||||
"*\\AltDefaultUserName",
|
||||
"*\\AltDefaultUserName",
|
||||
"*\\AltDefaultPassword",
|
||||
"*\\DisableCAD",
|
||||
"*\\DisableCAD",
|
||||
"*\\LegalNoticeCaption",
|
||||
"*\\LegalNoticeText",
|
||||
],
|
||||
"Operations": ["Write", "Delete", "Create"]
|
||||
"Operations": [
|
||||
"Write",
|
||||
"Delete",
|
||||
"Create",
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user