User Logoff Event — Detection Rule

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

Read the full analysis on IntelFusions