Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
Spotting the Adversary with Windows Event Log Monitoring
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Config<br />
MaxEnvelopeSizekb = 150<br />
MaxTimeoutms = 60000<br />
MaxBatchItems = 32000<br />
MaxProviderRequests = 4294967295<br />
Client<br />
NetworkDelayms = 5000<br />
URLPrefix = wsman<br />
AllowUnencrypted = false<br />
Auth<br />
Basic = true<br />
Digest = true<br />
Kerberos = true<br />
Negotiate = true<br />
Certificate = true<br />
CredSSP = false<br />
DefaultPorts<br />
HTTP = 5985<br />
HTTPS = 5986<br />
TrustedHosts<br />
Service<br />
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)<br />
MaxConcurrentOperations = 4294967295<br />
MaxConcurrentOperationsPerUser = 15<br />
EnumerationTimeoutms = 60000<br />
MaxConnections = 25<br />
MaxPacketRetrievalTimeSeconds = 120<br />
AllowUnencrypted = false<br />
Auth<br />
Basic = false<br />
Kerberos = true<br />
Negotiate = true<br />
Certificate = false<br />
CredSSP = false<br />
CbtHardeningLevel = Relaxed<br />
DefaultPorts<br />
HTTP = 5985<br />
HTTPS = 5986<br />
IPv4Filter = *<br />
IPv6Filter = *<br />
EnableCompatibilityHttpListener = false<br />
EnableCompatibilityHttpsListener = false<br />
CertificateThumbprint<br />
Winrs<br />
AllowRemoteShellAccess = true<br />
IdleTimeout = 180000<br />
MaxConcurrentUsers = 5<br />
MaxShellRunTime = 2147483647<br />
MaxProcessesPerShell = 15<br />
MaxMemoryPerShellMB = 150<br />
MaxShellsPerUser = 5<br />
Each of field of <strong>the</strong> above output is described in <strong>the</strong> following sections.<br />
7.4.1 Protocol Settings<br />
These settings are configurable options for <strong>the</strong> WS-Management protocol used by WinRM.<br />
53
Change language