Windows Credential Guard Disabled - Registry
Detects the modification of registry keys to disable Windows Defender Credential Guard. Disabling this security feature can expose credentials to theft and is a common precursor to lateral movement.
Microsoft Sentinel (KQL)
