From 98b60b9833c818227f2fcfdd6476bd4cb40967fc Mon Sep 17 00:00:00 2001 From: 87owo <85057800+87owo@users.noreply.github.com> Date: Tue, 14 Jul 2026 04:54:15 +0800 Subject: [PATCH] Add files via upload --- Plugins/Rules/Rules_Driver_P1.json | 711 +++++++++++++++++++++++++++++ 1 file changed, 711 insertions(+) create mode 100644 Plugins/Rules/Rules_Driver_P1.json diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json new file mode 100644 index 0000000..efcbb83 --- /dev/null +++ b/Plugins/Rules/Rules_Driver_P1.json @@ -0,0 +1,711 @@ +{ + "DynamicRules": [ + { + "Name": "Self_Antivirus_Protect_Command", + "Code": 1001, + "Kill": false, + "Category": "Process", + "Initiator": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe", + "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\wsl.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\bash.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\rundll32.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\rundll32.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\regsvr32.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\regsvr32.exe", + ], + "InitiatorExclude": [ + "*\\PYAS.exe", + ], + "CommandLine": [ + "*taskkill*PYAS.exe*", + "*taskkill*msedgewebview2.exe*", + "*Stop-Process*PYAS*", + "*Stop-Process*msedgewebview2*", + "*Get-Process*PYAS*Stop-Process*", + "*Get-Process*msedgewebview2*Stop-Process*", + "*wmic*PYAS.exe*call terminate*", + "*wmic*PYAS.exe*delete*", + "*wmic*msedgewebview2.exe*call terminate*", + "*wmic*msedgewebview2.exe*delete*", + "*net stop PYAS_Driver*", + "*net1 stop PYAS_Driver*", + "*sc stop PYAS_Driver*", + "*sc.exe stop PYAS_Driver*", + "*sc delete PYAS_Driver*", + "*sc.exe delete PYAS_Driver*", + "*fltmc unload PYAS_Driver*", + ], + "Operations": [ + "Execute", + ], + "Target": [ + "*\\taskkill.exe", + "*\\cmd.exe", + "*\\powershell.exe", + "*\\pwsh.exe", + "*\\wmic.exe", + "*\\net.exe", + "*\\net1.exe", + "*\\sc.exe", + "*\\fltmc.exe", + ], + "Priority": 110, + "FileOpenNameAvailable": true, + "SubsystemProcess": false, + }, + { + "Name": "Self_Antivirus_Protect_Handle", + "Code": 1002, + "Kill": false, + "Category": "Process", + "InitiatorExclude": [ + "*\\PYAS.exe", + "*\\PYAS_Setup.exe", + "*\\unins000.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe", + "\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\*\\gamingservices.exe", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\Lenovo\\SmartEngine\\*\\SmartEngineHost64.exe", + ], + "Target": [ + "*\\PYAS.exe", + "*\\msedgewebview2.exe", + ], + "TargetProcessTree": [ + "*\\PYAS.exe", + ], + "Operations": [ + "Terminate", + "SuspendResume", + "DuplicateHandle", + "CreateProcess", + "SetThreadToken", + "Impersonate", + ], + "Priority": 130, + "InitiatorProcessTreeExclude": [ + "*\\PYAS.exe", + ], + "HandleTypes": [ + "Create", + "Duplicate", + ], + "OperationMatch": "Any", + "MinimumRiskScore": 20, + "ObjectTypes": [ + "Process", + "Thread", + ] + }, + { + "Name": "Attack_Command_Block_EFI_Mount", + "Code": 1003, + "Kill": false, + "Category": "Process", + "Target": [ + "*\\mountvol.exe", + ], + "CommandLine": [ + "*mountvol* /S*", + ], + "Operations": [ + "Execute", + ], + "Priority": 170, + "FileOpenNameAvailable": true, + }, + { + "Name": "Attack_Command_Block_Destructive_Cmd_Delete", + "Code": 1004, + "Kill": true, + "Category": "Process", + "Target": [ + "*\\cmd.exe", + ], + "CommandLine": [ + "*rd /s /q C:\\*", + "*rmdir /s /q C:\\*", + "*del X:\\* /s /f /q*", + "*rd /s /q X:\\EFI*", + ], + "Operations": [ + "Execute", + ], + "Priority": 190, + "FileOpenNameAvailable": true, + }, + { + "Name": "Attack_Command_Block_Forced_OOBE_Sysprep", + "Code": 1005, + "Kill": false, + "Category": "Process", + "Target": [ + "*\\sysprep.exe", + ], + "CommandLine": [ + "*sysprep* /oobe*", + "*sysprep*/oobe*", + "* /oobe* /reboot*", + "* /generalize* /oobe*", + ], + "Operations": [ + "Execute", + ], + "Priority": 185, + "FileOpenNameAvailable": true, + }, + { + "Name": "Self_Antivirus_Protect_File", + "Code": 2001, + "Kill": false, + "Category": "File", + "InitiatorExclude": [ + "*\\PYAS.exe", + "*\\PYAS_Setup.exe", + "*\\unins000.exe", + "*\\notepad*.exe", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\PYAS_Setup.tmp", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Temp\\*\\_unins.tmp", + "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe", + ], + "Target": [ + "*\\PYAS.exe", + "*\\ProgramData\\PYAS\\*.json", + "*\\Engine\\Heuristic\\*.yar", + "*\\Engine\\Heuristic\\*.yara", + "*\\Engine\\Heuristic\\*.yc", + "*\\Engine\\Heuristic\\*.yrc", + "*\\Engine\\Heuristic\\*.ip", + "*\\Engine\\Heuristic\\*.txt", + "*\\Engine\\Pattern\\*.onnx", + "*\\Engine\\Properties\\*.json", + "*\\Engine\\Properties\\*.onnx", + "*\\Interface\\static\\css\\*.css", + "*\\Interface\\static\\img\\*.ico", + "*\\Interface\\static\\js\\*.js", + "*\\Interface\\templates\\*.html", + "*\\Plugins\\Filter\\*.sys", + "*\\Plugins\\Rules\\*.json", + ], + "Operations": [ + "Write", + "Delete", + ] + }, + { + "Name": "System_Boot_Protect_File", + "Code": 2002, + "Kill": true, + "Category": "File", + "InitiatorExclude": [ + "*\\PYAS.exe", + "*\\Huorong\\Sysdiag\\bin\\sysclean.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\SearchIndexer.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\TrustedInstaller.exe", + "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe", + "\\Device\\HarddiskVolume*\\$WinREAgent\\Scratch\\*\\DismHost.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\bootmgr", + "\\Device\\HarddiskVolume*\\boot.ini", + "\\Device\\HarddiskVolume*\\BOOTNXT", + "\\Device\\HarddiskVolume*\\EFI\\*", + "\\Device\\HarddiskVolume*\\Boot\\*", + "\\Device\\HarddiskVolume*\\Recovery\\*", + ], + "Operations": [ + "Write", + "Delete", + ] + }, + { + "Name": "Illegal_Characters_Protect_File", + "Code": 2003, + "Kill": false, + "Category": "File", + "InitiatorExclude": [ + "*\\PYAS.exe", + ], + "Target": [ + "*\\CON", + "*\\CON\\*", + "*\\PRN", + "*\\PRN\\*", + "*\\AUX", + "*\\AUX\\*", + "*\\NUL", + "*\\NUL\\*", + "*\\COM?", + "*\\COM?\\*", + "*\\LPT?", + "*\\LPT?\\*", + "*\\OSDATA", + "*\\OSDATA\\*", + "*\\*<*", + "*\\*>*", + ], + "Operations": [ + "Create", + "Write", + "Rename", + ] + }, + { + "Name": "System_Ransom_Protect_File", + "Code": 2004, + "Kill": true, + "Category": "File", + "Initiator": [ + "\\Device\\HarddiskVolume*\\Windows\\System32\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cmd.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\WindowsPowerShell\\*\\powershell.exe", + "\\Device\\HarddiskVolume*\\Program Files\\PowerShell\\*\\pwsh.exe", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\PowerShell\\*\\pwsh.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\wscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\wscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\cscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cscript.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\mshta.exe", + "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\mshta.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + ], + "TargetExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\Temp\\*", + "\\Device\\HarddiskVolume*\\Windows\\SystemTemp\\*", + "\\Device\\HarddiskVolume*\\Windows\\Prefetch\\*", + "\\Device\\HarddiskVolume*\\Windows\\Logs\\*", + "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*", + "\\Device\\HarddiskVolume*\\Windows\\servicing\\*", + ], + "Operations": [ + "Delete", + "Rename", + ], + "Threshold": 50, + "TimeWindow": 3000, + }, + { + "Name": "User_Ransom_Protect_File", + "Code": 2005, + "Kill": true, + "Category": "File", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "*\\Google\\Chrome\\Application\\chrome.exe", + "*\\Microsoft\\Edge\\Application\\msedge.exe", + "*\\Microsoft\\Edge*\\Application\\*\\msedgewebview2.exe", + "*\\Microsoft\\Edge*\\Install\\*\\setup.exe", + "*\\Microsoft\\Edge*\\Application\\*\\Installer\\setup.exe", + "*\\Mozilla Firefox\\firefox.exe", + "*\\Thorium\\Application\\thorium.exe", + "*\\Steam\\steam.exe", + "*\\steam\\*\\steam.exe", + "*\\Steam\\steamapps\\common\\*", + "*\\Battle.net\\*\\Battle.net.exe", + "*\\Epic Games\\Launcher\\Portal\\Binaries\\*\\EpicGamesLauncher.exe", + "*\\PC4399_WPFLauncher.exe", + "*\\Neverness To Everness\\NTELauncher.exe", + "*\\ThunderEv.exe", + "*\\ThunderStart.exe", + "*\\bin\\APlayer.exe", + "*\\bilibili\\bilibili.exe", + "*\\KuGou.exe", + "*\\XLGame.exe", + "*\\XLLiveUD.exe", + "*\\hrkill-*.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + "*\\WPS Office\\ksolaunch.exe", + "*\\WPS Office\\*\\wps.exe", + "*\\Application\\AndrowsLauncher.exe", + "*\\resources\\bin\\SDK\\DownloadSDKServer.exe", + "*\\bin\\*\\codex.exe", + "*\\bin\\codex.exe", + "*\\Weixin\\Weixin.exe", + ], + "Target": [ + "\\Device\\HarddiskVolume*\\Users\\*", + ], + "TargetExclude": [ + "*\\Documents\\My Games\\*", + "*\\Documents\\Tencent Files\\*", + "*\\Documents\\WeChat Files\\*", + "*\\Documents\\WPS Cloud Files\\*", + "*\\Users\\*\\steam\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\User Data\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\Temp\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\Local\\Temp\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\cache\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.cache\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.aws\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.codex\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.designer\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.idlerc\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.keras\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.matplotlib\\*", + "\\Device\\HarddiskVolume*\\Users\\*\\.ssh\\*", + "*\\ventoy\\Boot\\*", + "*\\AdminRegionConfig.*", + "*\\nt_qq\\nt_*\\*", + ], + "Extensions": [ + ".zip", + ".7z", + ".rar", + ".tar", + ".gz", + ".ppt", + ".pptx", + ".wps", + ".txt", + ".rtf", + ".pdf", + ".xls", + ".xlsx", + ".doc", + ".docx", + ".jpg", + ".jpeg", + ".png", + ".webp", + ".gif", + ".mp3", + ".wav", + ".aac", + ".ogg", + ".flac", + ".mp4", + ".avi", + ".mov", + ".wmv", + ".mkv", + ".apk", + ".jar", + ".class", + ".db", + ".sqlite", + ".sqlite3", + ".mdb", + ".accdb", + ], + "Operations": [ + "Write", + "Delete", + "Rename", + ], + "Threshold": 5, + "TimeWindow": 3000, + }, + { + "Name": "System_Boot_Protect_Disk_Wiper", + "Code": 2006, + "Kill": false, + "Category": "Device", + "InitiatorExclude": [ + "*\\PYAS.exe", + "*\\rufus-*.exe", + "*\\DiskInfo*.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\diskpart.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\diskmgmt.msc", + "\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\vds.exe", + "\\Device\\HarddiskVolume*\\Windows\\System32\\format.com", + ], + "Operations": [ + "Ioctl", + ] + }, + { + "Name": "Registry_Protect_System_Suspicious", + "Code": 3001, + "Kill": false, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\hrkill-*.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "*\\mouclass", + "*\\kbdclass", + "*\\DisableAntiSpyware", + "*\\DisableWindowsUpdateAccess", + "*\\NoWindowsUpdate", + "*\\AutoAdminLogon", + "*\\DefaultUserName", + "*\\DefaultPassword", + "*\\AltDefaultUserName", + "*\\AltDefaultPassword", + "*\\LegalNoticeCaption", + "*\\LegalNoticeText", + "*\\AutoReboot", + "*\\DisableAutomaticRestartOnFailure", + "*\\SystemBiosVersion", + "*\\ClearRecentDocsOnExit", + "*\\HideClock", + "*\\HideFastUserSwitching", + "*\\ShutdownWithoutLogon", + "*\\DisableCAD", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 130, + }, + { + "Name": "Registry_Protect_Open_With_Suspicious", + "Code": 3002, + "Kill": false, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\Program Files\\*", + "\\Device\\HarddiskVolume*\\Program Files (x86)\\*", + "*\\PYAS.exe", + ], + "Target": [ + "*\\Classes\\.exe", + "*\\Classes\\.com", + "*\\Classes\\.bat", + "*\\Classes\\.cmd", + "*\\Classes\\exefile\\*", + "*\\Classes\\comfile\\*", + "*\\Classes\\batfile\\*", + "*\\Classes\\cmdfile\\*", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 150, + }, + { + "Name": "Registry_Protect_BCD_Suspicious", + "Code": 3003, + "Kill": false, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\PYAS.exe", + ], + "Target": [ + "\\REGISTRY\\MACHINE\\BCD00000000", + "\\REGISTRY\\MACHINE\\BCD00000000\\*", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 140, + }, + { + "Name": "Registry_Protect_System_Critical", + "Code": 3004, + "Kill": true, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "*\\PYAS.exe", + ], + "Target": [ + "*\\EnableLUA", + "*\\ConsentPromptBehaviorAdmin", + "*\\ConsentPromptBehaviorUser", + "*\\EnableSecureUIAPaths", + "*\\BootExecute", + "*\\SubSystems", + "*\\FirmwareBootDevice", + "*\\BootDriverFlags", + "*\\SystemStartOptions", + "*\\Userinit", + "*\\UIHost", + "*\\Debugger", + "*\\NoControlPanel", + "*\\NoDrives", + "*\\NoFileMenu", + "*\\NoFind", + "*\\NoStartMenuPinnedList", + "*\\NoSetFolders", + "*\\NoSetFolderOptions", + "*\\NoViewOnDrive", + "*\\NoClose", + "*\\NoDesktop", + "*\\NoLogoff", + "*\\NoFolderOptions", + "*\\RestrictRun", + "*\\NoViewContextMenu", + "*\\NoStartMenuMyGames", + "*\\NoStartMenuMyMusic", + "*\\DisableCMD", + "*\\NoAddingComponents", + "*\\NoWinKeys", + "*\\NoStartMenuLogOff", + "*\\NoSimpleNetIDList", + "*\\NoLowDiskSpaceChecks", + "*\\DisableLockWorkstation", + "*\\Restrict_Run", + "*\\DisableTaskMgr", + "*\\DisableRegistryTools", + "*\\DisableChangePassword", + "*\\NoComponents", + "*\\NoStartMenuMorePrograms", + "*\\NoActiveDesktop", + "*\\NoSetActiveDesktop", + "*\\NoRecentDocsMenu", + "*\\NoChangeStartMenu", + "*\\NoFavoritesMenu", + "*\\NoRecentDocsHistory", + "*\\NoSetTaskbar", + "*\\NoSMHelp", + "*\\NoTrayContextMenu", + "*\\NoManageMyComputerVerb", + "*\\NoRealMode", + "*\\NoRun", + "*\\NoActiveDesktopChanges", + "*\\NoStartMenuNetworkPlaces", + "*\\NoLockScreen", + "*\\NoSRM", + "*\\NoInteractiveServices", + "*\\NoTheme", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 180, + }, + { + "Name": "Registry_Protect_SafeMode_Autostart", + "Code": 3005, + "Kill": true, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Sources\\SetupHost.exe", + "*\\Work\\*\\DismHost.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Minimal\\*", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Network\\*", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\AlternateShell\\*", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\Option\\*", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 170, + }, + { + "Name": "Registry_Protect_Pending_File_Rename", + "Code": 3006, + "Kill": false, + "Category": "Registry", + "InitiatorExclude": [ + "\\Device\\HarddiskVolume*\\Windows\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*", + "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*", + "*\\Sources\\SetupHost.exe", + "*\\Work\\*\\DismHost.exe", + "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe", + "*\\360Safe.exe", + "*\\PYAS.exe", + ], + "Target": [ + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations", + "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations2", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 140, + }, + { + "Name": "Registry_Protect_OOBE_Reset", + "Code": 3007, + "Kill": true, + "Category": "Registry", + "InitiatorExclude": [ + "*\\Sources\\SetupHost.exe", + "*\\Work\\*\\DismHost.exe", + "*\\Windows\\System32\\Sysprep\\sysprep.exe", + "*\\Windows\\System32\\oobe\\*", + "*\\PYAS.exe", + ], + "Target": [ + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\OOBEInProgress", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupType", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\CmdLine", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\AuditInProgress", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\MiniSetupInProgress", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\SetupPhase", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\SysprepStatus\\*", + "\\REGISTRY\\MACHINE\\SYSTEM\\Setup\\Status\\ChildCompletion\\*", + "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State\\ImageState", + "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\OOBE\\*", + "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\*", + ], + "Operations": [ + "Write", + "Delete", + "Create", + ], + "Priority": 175, + }, + ] +}