Tag
This brief details a detection capability for monitoring the creation of Portable Executable files using Sysmon Event ID 29 to identify unauthorized binary drops.