LSA Anonymous Access Enabled via Registry Modification
Detects command-line registry modifications that explicitly enable anonymous LSA enumeration. This action can lower the environment's security posture and aid in internal network discovery, a technique observed in operations like The Gentlemen RaaS.
CQL
