Registry os actor process signature vendor != Bromium, Inc. AND registry data = 0 AND registry value name = EnableSmartScreen AND action type = set_registry_value Process initiator path != *windows defender* AND cgo path != *windows defender* AND os parent path != *windows defender* AND initiated by != svchost.exe AND ccmexec.exe AND mmc.exe AND cgo name != svchost.exe AND ccmexec.exe AND mmc.exe AND os parent name != svchost.exe AND ccmexec.exe AND mmc.exe AND initiator signer != Bromium, Inc. AND cgo signer != Bromium, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows