SSRG601 - WScript or CScript Dropper

spicosolutions / thepeoplessiem

Patronus Support Portal

0 stars 0 forks source link

SSRG601 - WScript or CScript Dropper #34

Closed TomDiTullio closed 2 years ago

TomDiTullio commented 2 years ago

Source is source="WinEventLog:Microsoft-Windows-Sysmon/Operational" when it needs to be source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"