No need to guess, the evidence is already there.

Powershell command can help you retrieve all software installation and removal events from the Event Log. The WinEvent option can go through the log files, filter based on source, and show the result.

Microsoft has always overlooked centralized logging in Windows. To date, the most effective way to centralize Windows Event Logs has been through event log to syslog tools and custom agents for the ...

Japan's Computer Emergency Response Center (JPCERT/CC) has shared tips on detecting different ransomware gang's attacks based on entries in Windows Event Logs, providing timely detection of ongoing ...