| 用途 | 持久化动作时间线 |
|---|---|
| 字段 | TargetObject / Details / Image |
筛查
筛查
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
Where-Object { $_.Id -eq 13 -and $_.Message -match 'CurrentVersion..Run|Services' } | Select-Object -First 15 TimeCreated, Message写入时点与随后进程启动、网络外联串联成链。