I think it would be nice if there would be a verbose mode where we would get more infos regarding the warning/alert.
As an example: Right now, I can only see "Method: Stack Base + VAD Inspection | Injected Thread" for a process injection, but not what telemetry BEOTM used to gather the neccessary infos and trigger the decetion (e.g. the kernel callback "PsSetCreateThreadNotifyRoutine" was used for the detection or ETWti).
I think it would be nice if there would be a verbose mode where we would get more infos regarding the warning/alert.
As an example: Right now, I can only see "Method: Stack Base + VAD Inspection | Injected Thread" for a process injection, but not what telemetry BEOTM used to gather the neccessary infos and trigger the decetion (e.g. the kernel callback "PsSetCreateThreadNotifyRoutine" was used for the detection or ETWti).