Winlogon AllowMultipleTSSessions Enabled
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
Sigma
