Skip to content

Instantly share code, notes, and snippets.

@terasaka

terasaka/login_ip

Last active July 30, 2020 15:45
Show Gist options
  • Save terasaka/179e305708b2bfc61fe3981ca6f33700 to your computer and use it in GitHub Desktop.
Save terasaka/179e305708b2bfc61fe3981ca6f33700 to your computer and use it in GitHub Desktop.
Download ZIP
Eventviewer - Lista login de conta por origem de IP
Raw
login_ip
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[EventData[Data[@Name='TargetUserName']='login.to.search']] and *[EventData[Data[@Name='IpAddress'] and (Data='10.0.0.1' or Data='10.0.0.2' or Data='10.0.0.3')]] </Select>
</Query>
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment