Software Management Detection Rules for HKCU registry keys when running managed delivery policy with Currently Logged in User.
Detection rules are evaluated with the Agent credentials (System account).
Access to "HKEY_CURRENT_USER" is redirected to "HKEY_USERS\.DEFAULT".
This is working as per the current design. It is recommended to use HKLM based registry keys for detection rules accessing the registry. NOTE: A backslash must be used at the end of any registry key path within a detection rule.