🔍
Windows Forensic Handbook
Ctrl
k
Copy
Artifacts by Activity
👨🔧
Account Activity
Logon ID
EventID 4624: An account was successfully logged on
EventID 4688: A new process has been created
Last updated
2 years ago