PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(winrm): Exchange strict mode to suppress false 91/4624 alerts

Browse Source 
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
2026-06-05 11:07:21 +10:00
parent fe2e6d624f
commit 80b2337d61
6 changed files with 116 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
version.txt
+1 -1
View File
@@ -1 +1 @@
2.0.22-SAC
2.0.23-SAC