admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding connection monitoring support to rdp terminal services pipe, can be abused maliciously

Browse Source
This commit is contained in:
Tim Shelton
2022-02-23 20:02:54 +00:00
parent 640305578c
commit 184f5d8f45
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
17_18_pipe_event/include_tsvcpipe.xml
+11
View File
@@ -0,0 +1,11 @@
<Sysmon schemaversion="4.30">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<PipeEvent onmatch="include">
<Rule groupRelation="and">
<PipeName condition="begin with">\TSVCPIPE</PipeName>
</Rule>
</PipeEvent>
</RuleGroup>
</EventFiltering>
</Sysmon>