Please include a summary of the change and (if applicable) which issue is fixed.
Checklist:
Please replace every instance of [ ] with [X]
[ ] I have ensured a Provider is listed for the new Map(s) being submitted
[ ] I have ensured the filename(s) of any new Map(s) being submitted follows the approved format, i.e. Channel-Name_Provider-Name_EventID.map (all spaces and special characters are replaced with a hyphen)
[ ] I have tested and validated the new Map(s) work with my test data and achieve the desired output
[ ] I have provided example event data at the bottom of my Map(s)
[ ] I have consulted the guide/template to ensure my Map(s) follow the same format
Thank you for your submission and for contributing to the DFIR community!
…onal_Microsoft-Windows-TerminalServices-LocalSessionManager_40.map
Description
Please include a summary of the change and (if applicable) which issue is fixed.
Checklist:
Please replace every instance of
[ ]with[X]Thank you for your submission and for contributing to the DFIR community!