Encoded PowerShell spawning reg.exe to enable RDP (fDenyTSConnections=0)
Detects PowerShell execution with an encoded command that invokes reg.exe to modify the Terminal Server registry settings, specifically setting fDenyTSConnections to 0 to enable Remote Desktop.
Microsoft Sentinel (KQL)
