STAC4749 RDP Enablement via msconfig or fDenyTSConnections
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Microsoft Sentinel (KQL)
