https://attack.mitre.org/datacomponents/DC0064/
There seems to be an entry for WinEventLog:Security, EventCode 4104. Should this be corrected/ removed? There also seems to be WinEventLog:PowerShell, EventCode=4104 in the same data component, which is probably more correct.
https://attack.mitre.org/datacomponents/DC0064/
There seems to be an entry for WinEventLog:Security, EventCode 4104. Should this be corrected/ removed? There also seems to be WinEventLog:PowerShell, EventCode=4104 in the same data component, which is probably more correct.