Use Sysmon to detect attempts to mess with your event log service and stay on top of red team tactics - #dfir, #EventLog 
... and #dfir can surface sysmon-based detections for such in-memory attacks in #AzureSecurityCenter - read how at azure.microsoft.com/en-us/blog/det…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
