This article continues on the subject of using EDR telemetry to search for potential security vulnerabilities, the basics of which I have covered in the first part: https://hackingiscool.pl/using-edr-telemetry-for-offensive-research/. In that part I mentioned that having base events carrying information on file (or any other securable object) permissions
