Apparently Windows 11 writes full WebAuthn assertions into the event log https://specterops.io/wp-content/uploads/sites/3/2026/08/Pass-the-Passkey_A4_v2.pdf