Module
Endpoint Investigation: Process Trees & Command Lines
Open a Windows endpoint alert, find the one process chain that matters among hundreds of rows, read its command lines to say what they did, and write a verdict with the exact lines that prove it. When the log can't answer, say so and name what is missing.
70 min
Start Endpoint Investigation: Process Trees & Command Lines
Lessons
what-the-log-records
who-raised-it
reading-a-command-line
same-binary-two-stories
the-verdict