RestrictedAdminMode Registry Value Tampering via Process Creation
Detects changes to the "DisableRestrictedAdmin" registry value via process creation events. This registry value controls RestrictedAdmin mode, which prevents the transmission of reusable credentials to a remote system during Remote Desktop connections, thereby mitigating credential harvesting if the remote server is compromised. This rule specifically looks for command-line arguments that indicate an attempt to modify this registry key.
Sigma
