Skip to content
.evtx

Posts tagged "{tag}": #windows-event-logs

← ← Back to blog
EVTX triage: what to read first when you have an hour and a host
A practitioner's order of operations for triaging Windows Event Logs during incident response — which channels matter, which event IDs lie to you, and where Sysmon does the heavy lifting.
evtxincident-responsewindows-event-logssysmon