RestrictedAdmin Mode Registry Value Tampering
Detects changes to the "DisableRestrictedAdmin" registry value, which controls RestrictedAdmin mode. Disabling RestrictedAdmin mode can expose credentials to compromise during Remote Desktop Protocol (RDP) connections, making it easier for adversaries to harvest credentials during lateral movement. This rule identifies modifications to this critical security setting.
YARA-L
