NTLM downgrade attack (Reg via SYSMON)

Detects scenarios where an attacker modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.