mirror of
https://github.com/gnh1201/welsonjs.git
synced 2025-02-11 09:24:58 +00:00
Update FileEventMonitor.cs
This commit is contained in:
parent
672a3637de
commit
bc74515095
|
@ -75,7 +75,7 @@ namespace WelsonJS.Service
|
|||
{
|
||||
string query = @"<QueryList>
|
||||
<Query Id='0' Path='Microsoft-Windows-Sysmon/Operational'>
|
||||
<Select Path='Microsoft-Windows-Sysmon/Operational'>*[System/EventID=11 or System/EventID=3]</Select>
|
||||
<Select Path='Microsoft-Windows-Sysmon/Operational'>*[System/EventID=11 or System/EventID=3 or System/EventID=12 or System/EventID=13 or System/EventID=14]</Select>
|
||||
</Query>
|
||||
</QueryList>";
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user