#hack100days : day 58 : Spent some time poking around log sources. Checked for logging and events matching oppsec warnings from CRTO. Created and tuned some queries for Defender ATH. There's signal in there about Registry run key creation and scheduled task creation. Good to know for #redteam and #blueteam! #CoSoSec