09:09
2 hours later…
11:20
0
I have an IIS server and while monitoring the windows logs I encounter an interesting sysmon log. It was an Event ID 7: Image loaded log which showed that w3wp.exe loaded wmiutils.dl. They're both legitimate versions and not tampered with. The w3wp.exe has a normal parent process too. All I want ...
12:13
@MechMK1 It looks like it has enough details now, but it's asking "All I want to know is if there is a scenario that this behavior would count as non-malicious?" Now I don't know much about this sort of stuff, but I'm wondering the exact opposite. Is there any scenario where this would be suspicious?
« first day (3928 days earlier) ← previous day next day → last day (1174 days later) »