Windows Security Policy Dump and Review via Notepad
Detects scenarios where a security policy is exported to a .cfg file using secedit.exe and subsequently accessed/reviewed using notepad.exe on the same Windows host. This activity may indicate reconnaissance or staging for privilege escalation or lateral movement by a threat actor.
Microsoft Sentinel (KQL)
