For the three people that religiously read my blog, you know by now that I’ve been writing quite a bit on using SCOM to detect some of the anomalous events that are specific to an intruder in your environment. This is the first, of what will hopefully be a few rules needed to detect the…