fix: fixing bug
This commit is contained in:
@@ -18,13 +18,13 @@ detection:
|
||||
selection:
|
||||
EventID: 5156
|
||||
sourceRDP:
|
||||
SourcePort: 3389
|
||||
DestinationAddress:
|
||||
SourcePort: 3389
|
||||
- '127.*'
|
||||
- '::1'
|
||||
destinationRDP:
|
||||
DesinationPort: 3389
|
||||
SourceAddress:
|
||||
DesinationPort: 3389
|
||||
- '127.*'
|
||||
- '::1'
|
||||
condition: selection and ( sourceRDP or destinationRDP )
|
||||
|
||||
Reference in New Issue
Block a user