Enable Rdp Via Registry
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
YARA-L
