Create Windows.EventLogs.SysmonProcessEnriched.yaml

Velocidex / velociraptor-docs

Documentation site for Velociraptor

Other

35 stars 192 forks source link

Closed zaneGittins closed 2 months ago

zaneGittins commented 2 months ago

Artifact that enriches Sysmon process creation logs with the authenticode signature and the call chain.