Disabling RDP Restricted Admin Mode

Ethan Andrews@eandrews

•updated Jan 16, 2026•3•0•20

Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.