Forum Discussion
Ransomware: LockBit
I can't figure out what question 7 is looking for as the answer. I ensured I was looking at logs with an EventType of SetValue, I ensured it was LockBit.exe doing the event, but nothing I've tried from that works for the answer. Either I'm querying something wrong, or
1 Reply
Nevermind. Figured it out by looking at all the Type 13 logs.
