Forum Discussion
Ransomware: LockBit
I can't figure out what question 7 is looking for as the answer. I ensured I was looking at logs with an EventType of SetValue, I ensured it was LockBit.exe doing the event, but nothing I've tried from that works for the answer. Either I'm querying something wrong, or
4 Replies
Nevermind. Figured it out by looking at all the Type 13 logs.
What was the answer, I am struggling to figure this out?
It's asking for the first change, so you need to sort the events - the _time field only goes down to the second so there are a whole lot of events in the same second; the UtcTime is more precise - sort on that and get the first one. It just wants the channel name by itself.
