Invoke-FindEventCreds. PowerShell script to parse Sysmon Event ID 1 and Security Event Log ID 4688 for command line credentials
github.com/The-Viper-One/Invoke-FindEventCreds
Problem
Audience
Updates
No founder updates yet. Check back soon.
Problem
Audience