My key takeaways there is a POC proving persistence by writing/reading shellcode from Event ...