Unusual Creation of NTUSER.MAN
The rule detects write access to files named NTUSER.MAN by monitoring Windows Security Event Log event ID 4663.
Splunk (SPL)
The rule detects write access to files named NTUSER.MAN by monitoring Windows Security Event Log event ID 4663.
Already have an account?