From 5b4cd6e87990584ad43cd850870f463032ee2fa0 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:55:36 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 149 +----------------------------
 1 file changed, 1 insertion(+), 148 deletions(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 13bea4c..34b32cf 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -196,153 +196,6 @@
             ],
             "Priority": 160,
         },
-        {
-            "Name": "Memory_Protect_Critical_Process_CreateRemoteThread",
-            "Code": 1007,
-            "Kill": false,
-            "Category": "Memory",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\Program Files\\*",
-                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
-            ],
-            "Operations": [
-                "WriteMemory",
-                "VmOperation",
-                "CreateThread",
-            ],
-            "OperationMatch": "All",
-            "MinimumRiskScore": 90,
-            "HandleTypes": [
-                "Create",
-                "Duplicate",
-            ],
-            "ObjectTypes": [
-                "Process",
-            ],
-            "Priority": 175,
-        },
-        {
-            "Name": "Memory_Protect_Critical_Process_ThreadHijack",
-            "Code": 1008,
-            "Kill": false,
-            "Category": "Memory",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\Program Files\\*",
-                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\winlogon.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe",
-            ],
-            "Operations": [
-                "WriteMemory",
-                "VmOperation",
-                "SetThreadContext",
-            ],
-            "OperationMatch": "All",
-            "MinimumRiskScore": 90,
-            "HandleTypes": [
-                "Create",
-                "Duplicate",
-            ],
-            "ObjectTypes": [
-                "Process",
-            ],
-            "Priority": 175,
-        },
-        {
-            "Name": "Memory_Protect_Service_Process_CreateRemoteThread",
-            "Code": 1009,
-            "Kill": false,
-            "Category": "Memory",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\Program Files\\*",
-                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
-            ],
-            "Operations": [
-                "WriteMemory",
-                "VmOperation",
-                "CreateThread",
-            ],
-            "OperationMatch": "All",
-            "MinimumRiskScore": 90,
-            "HandleTypes": [
-                "Create",
-                "Duplicate",
-            ],
-            "ObjectTypes": [
-                "Process",
-            ],
-            "Priority": 170,
-        },
-        {
-            "Name": "Memory_Protect_Service_Process_ThreadHijack",
-            "Code": 1010,
-            "Kill": false,
-            "Category": "Memory",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\Program Files\\*",
-                "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\svchost.exe",
-                "\\Device\\HarddiskVolume*\\Windows\\System32\\spoolsv.exe",
-            ],
-            "Operations": [
-                "WriteMemory",
-                "VmOperation",
-                "SetThreadContext",
-            ],
-            "OperationMatch": "All",
-            "MinimumRiskScore": 90,
-            "HandleTypes": [
-                "Create",
-                "Duplicate",
-            ],
-            "ObjectTypes": [
-                "Process",
-            ],
-            "Priority": 170,
-        },
         {
             "Name": "Self_Antivirus_Protect_File",
             "Code": 2001,
@@ -586,7 +439,7 @@
                 "Delete",
                 "Rename",
             ],
-            "Threshold": 5,
+            "Threshold": 10,
             "TimeWindow": 3000,
         },
         {