EventType:DeleteValue TargetObject:SOFTWARE\\Microsoft\\Windows\ Defender\\Windows\ Defender\ Exploit\ Guard\\Controlled\ Folder\ Access\\ProtectedFolders*