17 h 17 m, 1 sept 2016 año - 新增防火牆例外名單(RDP)
Descripción:
\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx
A rule has been modified in the Windows Defender Firewall exception list.
Modified Rule:
Rule ID: RemoteDesktop-Shadow-In-TCP
Rule Name: 遠端桌面 - 陰影 (TCP-In)
Origin: 1
Active: 0
Direction: 1
Profiles: 4
Action: 3
Application Path: C:\Windows\system32\RdpSa.exe
Service Name:
Protocol: 6
Security Options: 0
Edge Traversal: 1
Modifying User: S-1-5-21-4013561640-1153130163-268913098-500
Modifying Application: C:\Windows\System32\SystemPropertiesRemote.exe
Añadido al timeline:
1081121-離職員工破壞伺服器案
fecha:
