Disabling Hypervisor-protected Code Integrity via Registry

registry where event.action == "modification" and 
 process.executable != null and 
 registry.path :
       ("HKLM\\SYSTEM\\*ControlSet*\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled",
        "HKLM\\SYSTEM\\*ControlSet*\\DeviceGuard\\HypervisorEnforcedCodeIntegrity") and 
 registry.data.strings : "0" and 
 not process.executable :
           ("?:\\Windows\\System32\\DeviceEnroller.exe",
            "?:\\Windows\\System32\\omadmclient.exe",
            "?:\\Windows\\System32\\svchost.exe",
            "?:\\Windows\\System32\\SecurityHealthService.exe",
            "?:\\Program Files\\HONOR\\PCManager\\MBAMessageCenter.exe",
            "?:\\Program Files (x86)\\ASUS\\AI Suite III\\AISuite3.exe",
            "C:\\Program Files\\Tenable\\Nessus Agent\\nessusd.exe",
            "C:\\Program Files (x86)\\Faronics\\Deep Freeze\\Install C-0\\DFServ.exe",
            "C:\\Program Files (x86)\\Common Files\\InstallShield\\engine\\?\\Intel 32\\IKernel.exe",
            "?:\\Windows\\regedit.exe",
            "C:\\Windows\\System32\\provtool.exe",
            "C:\\Windows\\System32\\backgroundTaskHost.exe",
            "C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe",
            "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
            "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
            "C:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
            "C:\\Program Files\\Omnilert\\Omnilert.exe") and
 not process.thread.Ext.call_stack_summary in
             ("sysfer.dll
| kernelbase.dll
| dggpext.dll
| policymanagerprecheck.dll
| policymanager.dll
| deviceenroller.exe
| kernel32.dll
| ntdll.dll",
              "sysfer.dll
| kernelbase.dll
| dggpext.dll
| enterprisecsps.dll
| configmanager2.dll
| enterprisecsps.dll
| configmanager2.dll
| coredpus.dll
| omadmclient.exe
| kernel32.dll
| ntdll.dll")