LocalAccountTokenFilterPolicy Modification
Monitors for modifications to the LocalAccountTokenFilterPolicy registry key being set to 1, a technique used by the IOX proxy (and SHADOW-EARTH-053) to enable Pass-the-Hash attacks and grant administrative rights to remote connections.
Microsoft Sentinel (KQL)
