Prevent changing registry value

This Expert rule prevents changing the registry value available in the hive HKLMS\test through the Registry Editor.

Note

Exploit Prevention is not supported in the ARM architecture.

Important

Make sure to validate this rule in a client test system before enforcing it wider.

Rule {
	Process {
		Include OBJECT_NAME {
			-v regedit.exe
		}
	}
Target {
	Match KEY {
		Include OBJECT_NAME {
			-v "HKLMS\\test**"
		}
		Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"
		}
	}
}

For more Expert Rules examples, visit the Trellix Github repository.