Ink Dragon Security Control Downgrade Via Registry
Detects modifications to the Windows Registry that disable critical security features, specifically related to Restricted Admin Mode, UAC remote token filtering, and DSRM logon behavior. Ink Dragon uses these modifications to facilitate lateral movement and maintain domain dominance.
YARA-L
