LoFP / application installers, software-management systems, and administrators may legitimately set systemcomponent during deployment, updates, packaging, or shared-device and kiosk hardening. confirm the matched branch, binary or uninstall target, initiating identity, host, parent process, and change window against the change record before adding a narrow exception.

any where host.os.type == "windows" and
(
  (
    event.category == "process" and event.type == "start" and
    (process.name : ("HideUL.exe", "HideUL_x64.exe") or ?process.pe.original_file_name : "HideUL.exe")
  ) or
  (
    event.category == "registry" and event.type == "change" and
    registry.value : "SystemComponent" and
    registry.path : (
      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*",
      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*"
    ) and
    registry.data.strings : ("1", "0x00000001") and
    not registry.path : "*Microsoft EdgeWebView\\SystemComponent" and
    not (
      registry.path : "*\\{*}\\SystemComponent" and
      process.executable : ("?:\\Windows\\System32\\msiexec.exe") and
      user.id : "S-1-5-18"
    )
  )
)