GreenPlasma DisableLockWorkstation Policy Modification
Detects unauthorized or unexpected modifications setting DisableLockWorkstation to 1 in the HKCU Policies path. This modification is explicitly used in the GreenPlasma exploit chain to retain interactive workstation access once SYSTEM execution is achieved.
Cortex XDR
