Apply suggestions from code review

swachchhanda000 · web-flow · commit bb5503865b09 · 2026-01-01T19:45:25.000+05:45
diff --git a/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml b/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml
@@ -37,8 +37,8 @@ detection:
             - 'si '  # SetItem Alias
     selection_key_base:
         CommandLine|contains:
-            - 'CurrentControlSet\Control\DeviceGuard'
-            - 'CurrentControlSet\Control\LSA'
+            - '\Control\DeviceGuard'
+            - '\Control\LSA'
             - 'Software\Policies\Microsoft\Windows\DeviceGuard'
     selection_key_specific:
         CommandLine|contains:
diff --git a/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml b/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml
@@ -1,4 +1,4 @@
-title: Windows Credential Guard Related Registry Values Deleted
+title: Windows Credential Guard Related Registry Value Deleted - Registry
 id: d645ef86-2396-48a1-a2b6-b629ca3f57ff
 related:
     - id: c629cc9b-8ddf-4282-9f10-6934ce3ea1ee

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-title: Windows Credential Guard Related Registry Values Deleted`
	`1`	`+title: Windows Credential Guard Related Registry Value Deleted - Registry`
`2`	`2`	`id: d645ef86-2396-48a1-a2b6-b629ca3f57ff`
`3`	`3`	`related:`
`4`	`4`	`- id: c629cc9b-8ddf-4282-9f10-6934ce3ea1ee`