This rule detects registry tampering that adversaries commonly use to blunt Windows security and management tools by altering internal tool settings. It focuses on modifications to policy keys that control Explorer and System behavior, which can disable security prompts, administrative features, or user interface components. TheDetection logic relies on Windows process_creation events and correlates three data sources: (1) Windows Registry changes (Windows Registry), (2) Process execution (Process), and (3) Command invocations (Command) that modify registry values via the reg.exe utility. Specifically, it flags reg.exe usage (Image ends with reg.exe or OriginalFileName reg.exe) where the CommandLine contains the add operation and where the command targets sensitive policy keys under SOFTWARE\