Archives
Trending
Support
Login
clear text
XML
Django
JavaScript
MATLAB
C
C++
C#
Python
SQL
Shell
Bash
Markdown
YAML
JSON
HTML
CSS
PHP
Java
Ruby
Go
Rust
Swift
Kotlin
Arduino
TypeScript
Perl
Autohotkey
Lua
SQF
R
Scala
Haskell
Groovy
Dart
Clojure
VB.NET
Objective-C
PowerShell
Bash
CoffeeScript
Verilog
## Get Process Termination events looking for specific processes via the event properties which are used to create the message get-winEvent -filterhash @{ ProviderName = '*security-audit*' ; id = 4689 ; StartTime = '08:00' } -Oldest | where { $_.properties[6].value -match 'pwsh|terminal' -and $_.properties[4].value -ne 0 }|select TimeCreated,@{n='Process';e={$_.Properties[6].value}},@{n='Exit Code';e={$_.properties[4].value}}
Mark as private (unlisted)
for 30 minutes
for 6 hours
for 1 day
for 1 week
for 1 month
for 1 year
everlasting (like CCCP)
