Lying to the Analyst: Event Log Rendering-Metadata Spoofing
1. Background: How Windows Turns a Number into a Sentence An event in the Windows event log is not a sentence. On disk, in the EVTX, an event is a numeric EventID, a publisher GUID, a set of binar...