From e699be6b2e166009a7a7297ebcbd2bbde2e2136d Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Fri, 24 Jul 2026 23:22:26 +0800
Subject: [PATCH] Update Rules_Driver_P1.json

---
 Plugins/Rules/Rules_Driver_P1.json | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index 34b32cf..7b20d2d 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -439,7 +439,7 @@
                 "Delete",
                 "Rename",
             ],
-            "Threshold": 10,
+            "Threshold": 5,
             "TimeWindow": 3000,
         },
         {
@@ -702,5 +702,19 @@
             ],
             "Priority": 175,
         },
+        {
+            "Name": "Registry_Ransom_Protect_System",
+            "Code": 3007,
+            "Kill": true,
+            "Category": "Registry",
+            "Operations": [
+                "Delete",
+            ],
+            "Target": [
+                "\\REGISTRY\\MACHINE\\*",
+            ],
+            "Threshold": 20,
+            "TimeWindow": 3000,
+        },
     ]
 }