sysmon_stopped by Pablo Delgado on October 31, 2017 in Previous article Monitoring the monitor: Sysmon status