TS Phish - NLA Disablement via Registry (T1562.001)
Hunts for the stager modifying the UserAuthentication registry key to disable Network Level Authentication (NLA) for RDP, lowering security requirements for the attacker.
Microsoft Sentinel (KQL)
Hunts for the stager modifying the UserAuthentication registry key to disable Network Level Authentication (NLA) for RDP, lowering security requirements for the attacker.
Already have an account?