Vijay
08/05/2020, 5:34 PMMike Myers
08/05/2020, 5:53 PMntfs_journal_events
table to watch for files created in the default shim database directories of “C:\Windows\AppPatch\Custom” and “C:\Windows\AppPatch\Custom\Custom64”appcompat_shims
table in osquery https://osquery.io/schema/4.4.0/#appcompat_shimspuffycid
08/06/2020, 12:00 AM