jiangzhaohua

Topics I've Started

for (eventcode=4672+eventcode=4624+eventcode=5140) occurs same time index=wineventlog (EventCode=4624 OR EventCode=4624 OR EventCode=5140) Authentication_Package=Negotiate | eval time = _time | bin span=1s time | stats dc(EventCode) as EventCode_count by host time | rename time as _time | where EventCode_count =3

Posts	1
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-28-2020

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Join the Conversation

Re: How to Detect Pass the Hash