Backdoor introduction via registry permission change through WMI (DAMP)

Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.