Detection rules › By event

Microsoft-Windows-TerminalServices-LocalSessionManager

Event	Rules
Event ID 21	2
Event ID 24	1
Event ID 25	1

Event ID 21

2 detection rules reference this event. View event page.

Sigma (2)

Ngrok Usage with Remote Desktop Service severity high T1090
RDP tunneling via ngrok detected severity high T1021, T1021.001, T1572

Event ID 24

1 detection rules reference this event. View event page.

Sigma (1)

RDP tunneling via ngrok detected severity high T1021, T1021.001, T1572

Event ID 25

1 detection rules reference this event. View event page.

Sigma (1)

RDP tunneling via ngrok detected severity high T1021, T1021.001, T1572