already there, read threads below for more details >No fancy EDR required to capture CVE-2020-0601 attempts (after patching). Just ensure you're forwarding App

already there, read threads below for more details >No fancy EDR required to capture CVE-2020-0601 attempts (after patching). Just ensure you're forwarding Application log events. Currently, CVE-2020-0601 is the only Microsoft code (AFAIK) that calls the CveEventWrite API so event noise is not a concern. https://twitter.com/mattifestation/status/1217179698008068096 https://twitter.com/mattifestation/status/121717969800806809...