feat: Add fps filters in some reg_set rules

Author: swachchhanda000

rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml

@@ -11,7 +11,7 @@ references:
     - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
 author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
 date: 2019-10-25
-modified: 2025-10-07
+modified: 2025-10-14
 tags:
     - attack.persistence
     - attack.t1547.001
@@ -50,6 +50,7 @@ detection:
             - '\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas'
             - '\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval'
         Details:
+            - 'DWORD (0x00000001)'
             - 'DWORD (0x00000009)'
             - 'DWORD (0x000003c0)'
     filter_main_runtimebroker:

rules/windows/registry/registry_set/registry_set_desktop_background_change.yml

@@ -16,7 +16,7 @@ references:
     - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI
 author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)
 date: 2023-12-21
-modified: 2025-10-08
+modified: 2025-10-14
 tags:
     - attack.defense-evasion
     - attack.impact
@@ -48,7 +48,12 @@ detection:
     filter_main_explorer:
         # Normally Explorer.exe is the process that changes the desktop background
         Image|endswith: 'C:\Windows\Explorer.EXE'
-    condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_*
+    filter_optional_ec2launch:
+        Image:
+            - 'C:\Program Files\Amazon\EC2Launch\EC2Launch.exe'
+            - 'C:\Program Files (x86)\Amazon\EC2Launch\EC2Launch.exe'
+        TargetObject|endswith: '\Control Panel\Desktop\Wallpaper'
+    condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Administrative scripts that change the desktop background to a company logo or other image.
 level: medium