Skip to content

Instantly share code, notes, and snippets.

@neu5ron

neu5ron/example 4663 wef subscription for canary files

Created January 4, 2018 07:23
Show Gist options
  • Save neu5ron/40874b46d4afc642725d0e00e32b3ddc to your computer and use it in GitHub Desktop.
Save neu5ron/40874b46d4afc642725d0e00e32b3ddc to your computer and use it in GitHub Desktop.
Download ZIP
Raw
example 4663 wef subscription for canary files
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[EventData[Data[@Name='ObjectName'] and (Data='C:\Users\Public\Documents\new-login-information.txt')]]
and
*[System[(EventID='4663')]]
</Select>
</Query>
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment