Sysinternals Sysmon suspicious activity guide – Windows Security
https://blogs.technet.microsoft.com/motiba/2017/12/07/sysinternals-sysmon-suspicious-activity-guide/

#sysmon #sysinternals #windows #forensics