Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/Detection for Auto Admin Logon

Last active February 15, 2022 18:05
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Shivammalaviya/56aa411187aecff794f0edbea3a4a999 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Shivammalaviya/56aa411187aecff794f0edbea3a4a999 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Detection for Auto Admin Logon
DeviceRegistryEvents
| where (RegistryKey contains @"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment