File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 855855 <TargetObject condition =" begin with" >HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_</TargetObject > <!-- Often used by malware -->
856856 <TargetObject condition =" begin with" >HKLM\SYSTEM\CurrentControlSet\Services\</TargetObject > <!-- Windows Services -->
857857 <!-- Windows:HVCI: Monitor HVCI being disabled via registry-->
858- <TargetObject name =" Tamper-HVCI" condition =" end with" >\Control\DeviceGuard\HypervisorEnforcedCodeIntegrity</TargetObject >
859- <TargetObject name =" Tamper-HVCI" condition =" end with" >\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled</TargetObject >
858+ <TargetObject name =" Tamper-HVCI" condition =" end with" >\Control\DeviceGuard\HypervisorEnforcedCodeIntegrity</TargetObject >
859+ <TargetObject name =" Tamper-HVCI" condition =" end with" >\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled</TargetObject >
860860 <TargetObject name =" Tamper-HVCI" condition =" end with" >\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity</TargetObject >
861861 <!-- Vulnerable Driver Blocklist Enable-->
862- <TargetObject name =" VulnerableDriverBlocklistEnable" condition =" end with" >\Control\CI\Config\VulnerableDriverBlocklistEnable</TargetObject >
862+ <TargetObject name =" VulnerableDriverBlocklistEnable" condition =" end with" >\Control\CI\Config\VulnerableDriverBlocklistEnable</TargetObject >
863863 </RegistryEvent >
864864 </RuleGroup >
865865
You can’t perform that action at this time.
0 commit comments