Blind Eagle HRDP Module Disables NLA and Hides Local Admin Account
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Microsoft Sentinel (KQL)
