Defense Evasion via Registry Modification

registry where not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and

 (process.code_signature.exists == false or
  process.name : ("powershell.exe", "reg.exe", "cscript.exe", "wscript.exe", "mshta.exe", "winword.exe", "excel.exe") or
  process.executable : ("?:\\Windows\\Microsoft.NET\\*", "?:\\Users\\Public\\*", "?:\\Users\\*\\AppData\\*")) and

 registry.path : ("HK*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*") and

 (
   (registry.value : ("EnableUA", "ConsentPromptBehaviorAdmin", "PromptOnSecureDesktop") and registry.data.strings : "0") or

   (registry.value : ("DisableTaskMgr", "DisableRegistryTools", "DisableArchiveScanning") and registry.data.strings : "1") or

    registry.value : "DisableCMD" or

    (registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance\\Enabled" and
     registry.data.strings : "0")
 ) and
 not (registry.value : "DisableTaskMgr" and
      process.executable : ("?:\\Program Files (x86)\\Green's MCI\\MCI.exe",
                            "?:\\Program Files (x86)\\Green's NV-MSVT\\NV-MSVT.exe",
                            "?:\\Program Files (x86)\\Green's MSVT\\MSVT.exe")) and
 not (process.code_signature.subject_name : ("Barco N.V.", "Advantig Corporation") and process.code_signature.trusted == true)