Detection rules › By catalog entry

Microsoft-Windows-TerminalServices-LocalSessionManager

Catalog entry	Rules
Event ID 21	2
Event ID 24	1
Event ID 25	1

Event ID 21

2 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

Ngrok Usage with Remote Desktop Service severity high T1090
RDP tunneling via ngrok detected severity high T1021,T1021.001,T1572

Event ID 24

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP tunneling via ngrok detected severity high T1021,T1021.001,T1572

Event ID 25

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP tunneling via ngrok detected severity high T1021,T1021.001,T1572

Back to all Microsoft-Windows-TerminalServices-LocalSessionManager catalog entries