remove another usage of cmdline
This commit is contained in:
Родитель
31f54eff25
Коммит
a7e3115cf6
|
@ -24,7 +24,7 @@ query: |
|
|||
SecurityEvent
|
||||
| where EventID == 4657
|
||||
| where ObjectName has "Image File Execution Options"
|
||||
| summarize Count=count() by Computer, CommandLine, Account, NewValue, OldValue
|
||||
| summarize Count=count() by Computer, Account, NewValue, OldValue
|
||||
| top 10 by Count desc
|
||||
| extend AccountCustomEntity = Account, HostCustomEntity = Computer
|
||||
),
|
||||
|
|
Загрузка…
Ссылка в новой задаче