admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

add adws

Browse Source
This commit is contained in:
Olaf Hartong
2023-06-21 12:56:02 +00:00
parent fed8170449
commit e0ce6676bf
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
3_network_connection_initiated/include_ports_suspicous.xml
+1
View File
@@ -15,6 +15,7 @@
<DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5900</DestinationPort> <!--VNC protocol-->
<DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5985</DestinationPort> <!--WinRM protocol-->
<DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5986</DestinationPort> <!--WinRM protocol-->
<DestinationPort name="technique_id=T1087.002,technique_name=Account Discovery: Domain Account" condition="is">9389</DestinationPort> <!--ADWS port-->
</NetworkConnect>
</RuleGroup>
</EventFiltering>