RID Hijacking via SAM Registry Manipulation
Detects unauthorized modifications to the SAM registry hive (specifically keys and values related to user account RIDs) by non-system processes, which is a technique used in RID hijacking to grant elevated privileges or create hidden accounts.
Microsoft Sentinel (KQL)
