My DFIR happy place is a Windows event log with 4688 events. Third-party IR consulting teaches you to have modest expectations at best.
6
9
59
sysmon event id 1 vs 4688 - which one is better ?
3
1
Replying to @charliesidjan
Hahaha Sysmon. I never get that. I rarely get the 4688s.

Mar 28, 2022 · 4:40 PM UTC
1