Windows Disable NLA for RDP via Command Prompt

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•4

Detects T1021.001 "Disable NLA for RDP via Command Prompt" (Remote Services: Remote Desktop Protocol) using command-line and process indicators derived from executor behavior.