UAC Disabled via Registry Modification
Detects when an attacker attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This action can be part of privilege escalation or defense evasion tactics to bypass UAC prompts.
Sigma
