Potential Suspicious Activity Using SeCEdit — Detection Rule

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read the full analysis on IntelFusions