Thursday, June 1, 2023

Custom View for Events NTLMv1 on a DC

 <QueryList>

  <Query Id="0" Path="Security">

    <Select Path="Security">*[System[(EventID=4624)] and EventData[Data[@Name='LmPackageName']='NTLM V1']]</Select>

  </Query>

</QueryList>

at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)