LSA Anonymous Access Enabled via Registry Modification
Detects command-line registry modifications that enable 'EveryoneIncludesAnonymous' or disable 'RestrictAnonymous' in the Local Security Authority (LSA) configuration. Attackers may perform these actions to lower the environment's security posture, explicitly allowing anonymous LSA enumeration, which aids in internal network discovery.
Microsoft Sentinel (KQL)
