🔍
Windows Forensic Handbook
Search...
Ctrl + K
Artifacts by Activity
🏃♂️
Execution
Command Line Options
Last updated
1 year ago
Task Scheduler Files
Task Scheduler Operational Log
EventID 4688: A new process has been created
EventID 9707: Command Execution Started