Microsoft has released Sysmon 15, converting it into a protected process and adding the new ‘FileExecutableDetected’ option to log when executable files are created. For those not familiar with Sysmon ...
The list of LOLBAS files - legitimate binaries and scripts present in Windows that can be abused for malicious purposes, will soon include the main executables for Microsoft’s Outlook email client and ...
Microsoft's Raymond Chen describes the string-matching heuristic behind the OS's system-file recovery.