remove another usage of cmdline

This commit is contained in:
Jannie Li 2021-07-01 13:25:21 -04:00
Родитель 31f54eff25
Коммит a7e3115cf6
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -24,7 +24,7 @@ query: |
SecurityEvent
| where EventID == 4657
| where ObjectName has "Image File Execution Options"
| summarize Count=count() by Computer, CommandLine, Account, NewValue, OldValue
| summarize Count=count() by Computer, Account, NewValue, OldValue
| top 10 by Count desc
| extend AccountCustomEntity = Account, HostCustomEntity = Computer
),