Windows Modify Registry Disable Restricted Admin

The analytic detects modifications to the Windows registry entry "DisableRestrictedAdmin," specifically when its value is set to 0x00000000. This action disables the Restricted Admin mode, a security feature that limits credential exposure during remote connections. Monitoring this activity is crucial as changes to this setting can weaken security controls, increasing the risk of credential theft and unauthorized access to sensitive systems. This detection leverages registry activity logs from endpoint data sources like Sysmon.