Results for “sysmon”

Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.

Provides cross-harness memory for agents by maintaining a local memex and offering commands to query, record, and check status across sessions.

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns.