Disabling RDP Restricted Admin Mode

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•3

Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.