🔍
Windows Forensic Handbook
Ctrl
K
Copy
Artifacts by Activity
🏃♂️
Execution
Execution Timestamp
Task Scheduler Operational Log
EventID 9707: Command Execution Started
Last updated
1 year ago