upon running the command SysmonSimulator.exe -eid 25 I see 3 events logged:
- eid 1 for self
- eid 1 for
Cmd.Exe &
- eid 5 to term self
But no event ID 25 in the sysmon logs. If it helps, sysmon is running swiftonsecurity default config. Thank you in advance!