https://www.sans.org/reading-room/whitepapers/microsoft/securing-giac-enterprise-endpoint-ise-m-6100-security-project-practicum-lab-notebook-36587