Karim El-Faramawi described in detail the dissecting obfuscator LLVM in his blog, as well as any possible shortcomings in the implementation of obfuscative passages.

Sysmon is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. Sysmon does not provide analysis of the events it generates, nor does it attempt to protect or hide itself from attackers. It runs in the background all the time and writes events to the event log.

Earlier we talked about the event log Windows-files. In this article we will talk about the detection and restoration of hidden tracks of the NSA. Part of the NSA framework cyber weapon DanderSpritz is eventlogedit, part of the software that is able to delete individual rows from the Windows event log files. Unfortunately, any criminal wishing to remove his traces on a compromised computer can use it.

Typically, the contents of the Windows event log files are useful for system administrators who troubleshoot system performance issues. One event record can alert the security team. Fox-IT reviewed the software and found a unique way to determine its use and restore deleted event [...]

There are several blogs on the Internet that tell you about a suitable method for monitoring Windows event log entries through Elasticsearch. It explains how to perform this process, including some documents from the Elastic team. This process requires a lot of effort to do it right.