For577 Sans Extra Quality [2021]

Using operating system logs and file structures to profile attacker activity. Enterprise IR