config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Software\Wow6432Node\Classes" and 
 (action_registry_key_name in ("*\Folder\ShellEx\ExtShellFolderViews*", "*\Folder\ShellEx\DragDropHandlers*", "*\Folder\ShellEx\ColumnHandlers*", "*\Directory\Shellex\DragDropHandlers*", "*\Directory\Shellex\CopyHookHandlers*", "*\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance*", "*\CLSID\{ABE3B9A4-257D-4B97-BD1A-294AF496222E}\Instance*", "*\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance*", "*\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance*", "*\AllFileSystemObjects\ShellEx\DragDropHandlers*", "*\ShellEx\PropertySheetHandlers*", "*\ShellEx\ContextMenuHandlers*")) and 
 (not 
 (action_registry_value_name = "(Empty)" or 
 action_registry_data = "(Empty)"))))