VKECE

<Sysmon schemaversion="4.22">
  <!-- Capture all hashes -->
  <HashAlgorithms>sha256</HashAlgorithms>
  <CheckRevocation />
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <!-- Event ID 1 == Process Creation. -->
      <ProcessCreate onmatch="include">
        <ParentImage name="T1015 Accessibility Features" condition="image">sethc.exe</ParentImage>
        <ParentImage name="T1015 Accessibility Features" condition="image">utilman.exe</ParentImage>

VKECE

How to pass the OSCP

1. Recon
2. Find vuln
3. Exploit
4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.