Explorer Policy NoLogOff Registry Value Set to Disable Log Off
Detects the modification of the 'NoLogOff' registry value under the Windows Explorer policies key. This policy, when enabled, prevents the 'Log Off' option from appearing in the Start menu, which may be an attempt by an adversary to impair user sessions or lock a user into a specific session on a compromised host.
Sigma
