Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs - JPCERT/CC Eyes | JPCERT Coordination Center official Blog

https://blogs.jpcert.or.jp/en/2024/09/windows.html