drop 4688 evtx csv · certutil mshta regsvr32 rundll32 bitsadmin and 40+ lolbins · suspicious command lines · export csv · runs locally
4688 csv
drop 4688 csv
or click
living-off-the-land binaries · commandline column required
drop 4688 evtx csv with commandline column