mirror of
https://github.com/socfortress/Wazuh-Rules.git
synced 2025-10-23 00:02:11 +00:00
14 lines
355 B
XML
14 lines
355 B
XML
<group name="windows,">
|
|
<rule id="100070" level="3">
|
|
<decoded_as>json</decoded_as>
|
|
<field name="LogonSession">\.+</field>
|
|
<field name="UserName">\.+</field>
|
|
<description>Windows Logon Sessions - Snapshot</description>
|
|
<mitre>
|
|
<id>T1078</id>
|
|
</mitre>
|
|
<options>no_full_log</options>
|
|
<group>windows_logonsessions,</group>
|
|
</rule>
|
|
</group>
|