PapaTramp
80b2337d61
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC. Co-authored-by: Cursor <cursoragent@cursor.com>
2 lines
14 B
Plaintext
2 lines
14 B
Plaintext
2.0.23-SAC
|