UAC Bypass via DelegateExecute Registry Modification

sequence by process.entity_id with maxspan=1m
  [process where event.action == "start" and
   process.Ext.token.integrity_level_name == "medium" and process.executable != null and not

   /* excludes OpenWith which is used to delegate handling a file type to a chosen program */
   process.executable : ("?:\\Windows\\System32\\OpenWith.exe", "?:\\Windows\\SysWOW64\\OpenWith.exe") and

   /* exclude signed third party programs */
   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and

   not (process.code_signature.subject_name in ("Stanislav Zinukhov", "Google Inc", "IP Zinukhov Stanislav Igorevich", "Vera") and
        process.code_signature.trusted == true) and

   not process.executable : "?:\\Windows\\explorer.exe" and

   not (process.executable : "C:\\Windows\\regedit.exe" and
        process.parent.executable : ("C:\\Program Files\\Omnissa\\DEM\\FlexService.exe", "C:\\Program Files\\Immidio\\Flex Profiles\\FlexService.exe"))
   ]
  [registry where
   registry.value : "DelegateExecute" and registry.hive : "HKEY_USERS" and
   not (process.executable : "?:\\Windows\\regedit.exe" and registry.path : "HKEY_USERS\\S-1-*_Classes\\AppX*\\Shell\\open\\command\\DelegateExecute") and
   not process.executable : "?:\\Windows\\explorer.exe"
   ]