Check Software Restriction Policies state: SRP blacklist rule is missing:
Query:
select * from registry where key like 'HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiersPaths%ItemData'Additional Query Info:
Platform: windows
Interval: 86400
JSON:
{ "queries": { "Disallowed_Paths_ItemData": { "query" : "select * from registry where key like 'HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiersPaths%ItemData'", "interval" : "86400", "platform" : "windows", "version": "", "description" : "Check Software Restriction Policies state: SRP blacklist rule is missing", "value" : "" } } }