RDP shadow session configuration enabled (registry)

Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.