Nightmare Eclipse - Enabling RDP via Registry
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Microsoft Sentinel (KQL)
