diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 34b32cf..7b20d2d 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -439,7 +439,7 @@
                 "Delete",
                 "Rename",
             ],
-            "Threshold": 10,
+            "Threshold": 5,
             "TimeWindow": 3000,
         },
         {
@@ -702,5 +702,19 @@
             ],
             "Priority": 175,
         },
+        {
+            "Name": "Registry_Ransom_Protect_System",
+            "Code": 3007,
+            "Kill": true,
+            "Category": "Registry",
+            "Operations": [
+                "Delete",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\*",
+            ],
+            "Threshold": 20,
+            "TimeWindow": 3000,
+        },
     ]
 }