🔍
Windows Forensic Handbook
Ctrl
k
Copy
Artifacts by Activity
🏃♂️
Execution
Execution Timestamp
Task Scheduler Operational Log
EventID 9707: Command Execution Started
Last updated
2 years ago