So this thing. Which leads me to ask "WHERE THE F*** HAS CveEventWrite() FUNCTION BEEN FOR THE PAST 30 YEARS"?????
Sorry for the ALL CAPs but now that they came up with it, in hindsight it looks pretty obvious that we should've been having this all along.
And not just Microsoft, but something we need to add everywhere, including Apple, Linux, Gnu, other open-source projects. We shouldn't just fix vulns, but add detection for attempted exploitation.
I mean, back in the day, Apache added logging for /cgi-bin/phf, because every web scanner looked for it, so it was an easy way to detect when you were being scanned. So it's not a new concept.
But with 20 years of hindsight, APT operators, massive data breaches, Splunking, and so on, it's become obvious this needs to be the norm.
