#hack100days : day 62 : Wasn't up for it yesterday, took a sick day. Did some poking around at a recent CVE. This led to another thread, though. Something that could lead to finding weird... Look for instances of the Windows process WerFault.exe starting. What was the parent process? What was the user id for the process? You may find something that is well broken and needs fixing--that cleans up log files--or something that needs further research. #ThreatHunting #BlueTeam #CoSoSec