SysmonQuiet icon indicating copy to clipboard operation
SysmonQuiet copied to clipboard

Published 20 hours ago • verified publisher icon ScriptIdiot
→

Metadata

RDLL for Cobalt Strike beacon to silence sysmon process

SysmonQuiet Reflective DLL

Most of the codes come from SEKTOR7 - Windows Evasion Course. This RDLL (requires SeDebugPrivilege privilege) will automatically locate sysmon process and patch its EtwEventWrite API, causing sysmon malfunctioning while the process and its threads are still running.

The effect lasts until next reboot / service restart

Usage - Cobalt Strike

Load SysmonQuiet.cna

beacon> SysmonQuiet

image

Credits

  • SEKTOR7 - Windows Evasion Course
  • https://github.com/stephenfewer/ReflectiveDLLInjection

← Metadata

85
Stars
16
Forks
Watchers

Owner

verified publisher icon ScriptIdiot

Metadata

RDLL for Cobalt Strike beacon to silence sysmon process

Back