Chainsaw Hunt
...

Log Tampering
...

~4 Times

 2022-10-27 08:32:26 │ ‣ System Logs Cleared         │ 104493       │ DESKTOP-DSM4PF8 │ forela-wkstn-gold │

Notable RDP
...

  • gladys RDP 2023-05-03 11:15:29
  • forela-wkstn-gold 2022-10-25 14:00:40

Sigma Notable Changes
...

  • Sysmon Configuration change 2023-05-03 11:15:12
  • Merlin, Talks to 52.56.142.81 Port 80, PID: 5768, Time: 2023-05-03 11:46:22.049

Answer 5 -> 52.56.142.81