Suspicious Windows Credential Guard Registry Manipulation Through CommandLine (via process_creation)

This rule detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, that can be used for lateral movement and privilege escalation. The rule matches anomalous command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags. Such behavior may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.