Cyberdefense/DeepBlueCLI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

typo: fixed "event 4013" to be "event 4103"

Browse Source
This commit is contained in:
Paul Masek
2019-07-24 16:36:34 -04:00
committed by GitHub
parent 5e796ca588
commit ea289ac312
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -136,7 +136,7 @@ Enable Windows command-line auditing: https://support.microsoft.com/en-us/kb/300
Requires auditing logon failures: https://technet.microsoft.com/en-us/library/cc976395.aspx Requires auditing logon failures: https://technet.microsoft.com/en-us/library/cc976395.aspx
### PowerShell auditing (PowerShell 5.0): ### PowerShell auditing (PowerShell 5.0):
DeepBlueCLI uses module logging (PowerShell event 4013) and script block logging (4104). It does not use transcription. DeepBlueCLI uses module logging (PowerShell event 4103) and script block logging (4104). It does not use transcription.
See: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html See: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html