Investigation Scenario 🔎

A user workstation executed gpedit.msc for an unknown reason.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

Comments

Posting Rules

  • Be respectful to others
  • No spam or self-promotion
  • Stay on topic
  • Follow Bluesky's terms of service