Hi Guys! I wanted to ask if anyone knew where the ...
# generalu
Usama Nathani
10/12/2020, 5:50 PMHi Guys! I wanted to ask if anyone knew where the base FileEventSubscriber for windows is defined?
a
alessandrogario
10/12/2020, 7:18 PM
Hey Usama! There is no file integrity monitoring on Windows, but we (tob, or more specifically @yossarian) have implemented support for reading the NTFS journal
alessandrogario
10/12/2020, 7:19 PM
it's in the table named ntfs_journal_events
u
Usama Nathani
10/12/2020, 8:40 PMokay thank you, I was trying to make yara_events work. Im still trying to implement it, fingers crossed
9 Views