GreenPlasma Policy Registry Key DACL Relaxation
Detects unexpected DACL modifications on critical policy keys (CloudFiles or System Policies). Relaxing these DACLs allows unprivileged actors to write values like DisableLockWorkstation, maintaining exploit persistence.
Cortex XDR
