Remote Registry Lateral Movement — Detection Rule

Detects remote RPC calls to modify the registry and possible execute code

Read the full analysis on IntelFusions