Articles about sysmon | UserComp.com

Issue Monitoring: Registry Modifications and Sysmon-Tracking for Integrated Camera Use

Laptop integrated camera stops working after disabling and enabling it. Registry modifications and Sysmon-Tracking may help identify the issue.

Windows Event ID 11: Policy.vpolfile created process (lsass.exe)

This article explains the meaning and implications of Event ID 11 in the Windows Sysmon event log, which indicates the creation of a VPOL file by the lsass.exe process.