Disable Administrative Share Creation at Startup
This rule detects attempts to disable the automatic creation of administrative shares (C$, ADMIN$) at system startup by modifying specific registry values. Adversaries might do this as a defense evasion technique to remove traces of their activity or to hinder forensic analysis, as administrative shares are often used for legitimate remote administration and can also be leveraged by attackers for lateral movement.
Sigma
