Windows Forensic Handbook
Search
Ctrl + K
Execution Timestamp
Task Scheduler Operational Log
EventID 9707: Command Execution Started
Last updated
6 months ago