EventLog Query
Query for Process execution from unusual directoriesQuery suspicious programs processed by the Task Scheduler using the Event LogQuery for unusual instances of rundll32.exe via the Event LogQuery for Unusual Instances of rundll32.exe making outbound network connections using SysMon DataQuery Suspicious Powershell Command Line ExecutionsQuery the Windows System Log for 104, 517, 1102
PreviousQuery Autorun locations for any item nested that is not digitally signedNextQuery for Process execution from unusual directories
Last updated