Azure-Sentinel/Hunting Queries/SecurityEvent/CommandsexecutedbyWMIonnewh...

4 строки
372 B
YAML

id: 8d5f8c5b-fccb-4fff-a901-c0ed9e48641c
name: Commands executed by WMI on new hosts - potential Impacket
description: |
'As part of content migration, this file is moved to new location. you can find here: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows%20Security%20Events/Hunting%20Queries/CommandsexecutedbyWMIonnewhosts-potentialImpacket.yaml'