# \#windows **URL:** https://community.limacharlie.com/tag/windows/3.md [Latest](https://community.limacharlie.com/latest.md) · [Categories](https://community.limacharlie.com/categories.md) · [Tags](https://community.limacharlie.com/tags.md) --- ## [Feature request — server-side timezone formatting for ts in query results](https://community.limacharlie.com/t/feature-request-server-side-timezone-formatting-for-ts-in-query-results/762)
**Author:** [@senior](https://community.limacharlie.com/u/senior)\ **Replies:** 0\ **Last updated:** [August 3, 2026, 8:50am UTC](https://community.limacharlie.com/t/feature-request-server-side-timezone-formatting-for-ts-in-query-results/762 "2026-08-03T08:50:09Z")
Greetings LC team, Running LimaCharlie as an MSSP with all customers in Africa/Nairobi (EAT, UTC+3). API and CLI query results return the ts field as a UTC-formatted string (e.g. ts: '2026-08-03 06:08:14'), which is cor… --- ## [EDR-Freeze](https://community.limacharlie.com/t/edr-freeze/481)
**Author:** [@cmd1775](https://community.limacharlie.com/u/cmd1775)\ **Replies:** 1\ **Last updated:** [September 24, 2025, 5:48pm UTC](https://community.limacharlie.com/t/edr-freeze/481 "2025-09-24T17:48:59Z")
Has anyone tested EDR-Freeze on LC? --- ## [SOURCE missing from SENSITIVE\_PROCESS\_ACCESS](https://community.limacharlie.com/t/source-missing-from-sensitive-process-access/428)
**Author:** [@joshlemon](https://community.limacharlie.com/u/joshlemon)\ **Replies:** 0\ **Last updated:** [July 22, 2025, 11:50pm UTC](https://community.limacharlie.com/t/source-missing-from-sensitive-process-access/428 "2025-07-22T23:50:19Z")
Following on from this comment, it looks like the SOURCE object is missing from the SENSITIVE\_PROCESS\_ACCESS event. This means you can’t determine what accessed the sensitive process. Below is a redacted sample event: … --- ## [Detecting Suspicious LSASS Access + Template String Example](https://community.limacharlie.com/t/detecting-suspicious-lsass-access-template-string-example/71)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 2:37pm UTC](https://community.limacharlie.com/t/detecting-suspicious-lsass-access-template-string-example/71 "2025-07-22T14:37:03Z")
Rule Description This rule is meant to provide an example of using a template in a report name (see Respond block below) to extract key fields from within the event that triggered the detection. Read more about template… --- ## [Help with Windows Defender false positives from Endpoint Protection](https://community.limacharlie.com/t/help-with-windows-defender-false-positives-from-endpoint-protection/347)
**Author:** [@chadmando](https://community.limacharlie.com/u/chadmando)\ **Replies:** 1\ **Last updated:** [July 11, 2025, 6:11pm UTC](https://community.limacharlie.com/t/help-with-windows-defender-false-positives-from-endpoint-protection/347 "2025-07-11T18:11:28Z")
I turned on the Endpoint Protection extension and it is pretty noisy. Does anyone know of work that has been done to parse out the Settings Changes that are worthy of investigation versus UX, feature changes, scan state… --- ## [Outside Business Hours Logon Detection](https://community.limacharlie.com/t/outside-business-hours-logon-detection/105)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 4\ **Last updated:** [March 27, 2025, 6:17pm UTC](https://community.limacharlie.com/t/outside-business-hours-logon-detection/105 "2025-03-27T18:17:31Z")
Rule Description This rule detects interactive logons outside of specified “business hours” using a regular expression pattern against the WEL UTC creation time of the event. Be sure to adjust the pattern for the correc… --- ## [Detecting Unauthorized Removable Media](https://community.limacharlie.com/t/detecting-unauthorized-removable-media/106)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [March 7, 2025, 9:37pm UTC](https://community.limacharlie.com/t/detecting-unauthorized-removable-media/106 "2025-03-07T21:37:09Z")
Rule Description Detect Non-Approved removable media on Windows devices, with support for volume name exclusions. Detect event: VOLUME\_MOUNT op: and rules: - op: is path: event/DEVICE\_TYPE value: "REMOVABLE"… --- ## [Developing A Baseline For Sensitive Process Access](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 18, 2025, 10:57pm UTC](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72 "2025-02-18T22:57:46Z")
Description of the query: A starter query which leverages field projection to provide a high-level view of SENSITIVE\_PROCESS\_ACCESS activity for an org for developing a baseline or identifying outliers. Query: -24h | … --- ## [Obfuscation in CLI arguments](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 5:42am UTC](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20 "2025-02-14T05:42:14Z")
Rule Description Looks for possible obfuscations in command line args (n^e^t u^s^er) Detect event: NEW\_PROCESS op: matches path: event/COMMAND\_LINE re: (?:\[a-zA-Z\]\\^)+\[a-zA-Z\] Respond - action: report name: Possib… --- ## [Automating Artifact Collection Upon Waking Sleeper Agents](https://community.limacharlie.com/t/automating-artifact-collection-upon-waking-sleeper-agents/21)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 6:24am UTC](https://community.limacharlie.com/t/automating-artifact-collection-upon-waking-sleeper-agents/21 "2025-02-14T06:24:09Z")
Rule Description This rule is designed for SLEEPER MODE deployments, where all agents are put to sleep and are only awakened in an IR scenario. It can easily be expanded upon to grab additional artifacts or even to init…