EricZimmerman / evtx

C# based evtx parser with lots of extras
MIT License
280 stars 59 forks source link

Sysmon 27 FileBlockExecutable #209

Closed forensenellanebbia closed 2 years ago

forensenellanebbia commented 2 years ago

Description

New map for Sysmon event ID 27 (FileBlockExecutable).

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

Thank you for your submission and for contributing to the DFIR community!