From fa1be109e32625f69d360fd210d33fb873b66855 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Fri, 17 Jul 2026 17:41:26 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Rules/Rules_Driver_P1.json | 29 ++---------------------------
 1 file changed, 2 insertions(+), 27 deletions(-)

diff --git a/Plugins/Rules/Rules_Driver_P1.json b/Plugins/Rules/Rules_Driver_P1.json
index eb1affb..fda3157 100644
--- a/Plugins/Rules/Rules_Driver_P1.json
+++ b/Plugins/Rules/Rules_Driver_P1.json
@@ -70,6 +70,7 @@
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\services.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
+                "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\SystemApps\\*\\SearchHost.exe",
                 "\\Device\\HarddiskVolume*\\Program Files\\*",
                 "\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
@@ -810,36 +811,10 @@
             "Priority": 170,
         },
         {
-            "Name": "Registry_Protect_Pending_File_Rename",
+            "Name": "Registry_Protect_OOBE_Reset",
             "Code": 3006,
             "Kill": false,
             "Category": "Registry",
-            "InitiatorExclude": [
-                "\\Device\\HarddiskVolume*\\Windows\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*",
-                "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\*",
-                "*\\Sources\\SetupHost.exe",
-                "*\\Work\\*\\DismHost.exe",
-                "*\\Huorong\\Sysdiag\\bin\\HipsDaemon.exe",
-                "*\\360Safe.exe",
-                "*\\PYAS.exe",
-            ],
-            "Target": [
-                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations",
-                "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\PendingFileRenameOperations2",
-            ],
-            "Operations": [
-                "Write",
-                "Delete",
-                "Create",
-            ],
-            "Priority": 140,
-        },
-        {
-            "Name": "Registry_Protect_OOBE_Reset",
-            "Code": 3007,
-            "Kill": true,
-            "Category": "Registry",
             "InitiatorExclude": [
                 "*\\Sources\\SetupHost.exe",
                 "*\\Work\\*\\DismHost.exe",