Using Sysmon and ETW For So Much More | By David Kennedy

Using Sysmon and ETW For So Much More Recently the team over at Microsoft’s SysInternals team Mark Russinovich and Thomas Garnier landed a new version of Sysmon v10 which adds a new event ID type Event ID 22 (DNS). If you are not familiar with Sysmon, it’s a free tool....