Data Source
DeviceLogonEvents
1 query tagged with this data source.
-
Analytics Rules
Detect Remote Shell Command Arrival Over Wire
Shell command that arrived over the network — outbound-then-inbound-executed script pattern uncommon in legitimate remote code execution.