From 48e14cd14382d843f27be4cf3ba78a5036b5deb1 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:29:39 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 34 +++---------------------------
 1 file changed, 3 insertions(+), 31 deletions(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 5dfc89f..7d47fe1 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -400,7 +400,8 @@
                 "*\\ventoy\\Boot\\*",
                 "*\\AdminRegionConfig.*",
                 "*\\nt_qq\\nt_*\\*",
-                "\\Device\\HarddiskVolume*\\Users\\*\\Documents\\Tencent Files\\*\\nt_qq\\nt_*\\*",
+                "*\\nt_qq\\global\\nt_*\\*",
+                "\\Device\\HarddiskVolume*\\Users\\*\\Documents\\Tencent Files\\*",
             ],
             "Extensions": [
                 ".zip",
@@ -439,7 +440,7 @@
                 "Delete",
                 "Rename",
             ],
-            "Threshold": 5,
+            "Threshold": 10,
             "TimeWindow": 3000,
         },
         {
@@ -702,34 +703,5 @@
             ],
             "Priority": 175,
         },
-        {
-            "Name": "Registry_Ransom_Protect_System",
-            "Code": 3007,
-            "Kill": true,
-            "Category": "Registry",
-            "Operations": [
-                "Delete",
-            ],
-            "InitiatorExclude": [
-                "*\\Windows\\servicing\\TrustedInstaller.exe",
-                "*\\Windows\\System32\\taskhostw.exe",
-                "*\\Windows\\System32\\svchost.exe",
-                "*\\Windows\\System32\\SearchIndexer.exe",
-                "*\\Windows\\System32\\spoolsv.exe",
-                "*\\Windows\\System32\\wbem\\WmiPrvSE.exe",
-                "*\\Windows\\WinSxS\\*\\TiWorker.exe",
-                "*\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\REGISTRY\\MACHINE\\*",
-                "\\REGISTRY\\USER\\*",
-            ],
-            "TargetExclude": [
-                "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\*"
-            ],
-            "Threshold": 20,
-            "TimeWindow": 3000,
-        },
     ]
 }
\ No newline at end of file