Registry registry key name = *\Software\Microsoft\SystemCertificates*\root\* , *\Software\Microsoft\SystemCertificates*\authroot\* , *\Software\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\root\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\authroot\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\certificationauthority\* , *\Software\Policy\Microsoft\SystemCertificates*\root\* , *\Software\Policy\Microsoft\SystemCertificates*\authroot\* , *\Software\Policy\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\EnterpriseCertificates*\root\* , *\Software\Microsoft\EnterpriseCertificates*\authroot\* , *\Software\Microsoft\EnterpriseCertificates*\certificationauthority\* AND registry key name != *disallowed* AND *protectedroots AND *certificates AND *crls* AND *ctls AND *autoupdate* AND *appcontainer* AND action type = create_registry_key Process initiated by != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe AND cgo name != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe Host host os = windows