reg add "HKCR\MIME\Database\Content Type\message/rfc822" /v extension /t reg_sz /d ".eml" /f
reg delete "HKCR\MIME\Database\Content Type\message/rfc822" /v CLSID /f
Restore back
reg add "HKCR\MIME\Database\Content Type\message/rfc822" ^
/v CLSI /t reg_sz /d "{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}" /f
reg delete "HKCR\MIME\Database\Content Type\message/rfc822" /v extension /f
SCCM Detection rule:

No comments:
Post a Comment