Detection rules › By eventMicrosoft-Windows-TerminalServices-LocalSessionManager event 211 detection rule reference this event. View event page.Sigma (1)Ngrok Usage with Remote Desktop Service severity high T1090