Carlos Perez
Carlos Perez
Scriptblock login is not the same as transcript. https://4sysops.com/archives/powershell-transcript-record-a-session-to-a-text-file/
Having so many agents is a bad mix since all will install minifilter drivers attach to the drives. What eventtypes are set in your sysmon config? Sent from my iPhone...
I mention it because when a minifilter is set for drives only the product with the lowest altitude number will trigger, report and/or block, you can not correlate between them....
Strange, only thing that comes to mind is the file is being hashed because it was logged by one of the rules. Have you used tools like resmon or procmon...
Interesting! Wonder why. Thanks for letting me know. Did you post the issue to the sysinternals forum for the devs to know? Sent from my iPhone > On Feb 10,...
Description is empty, can you provide one
Out of curiosity what is the lowest supported version of the Windows. Windows 2012 is EOL
I would recommend a shellstream since it seems to require a interactive session and commands in ssh.net are more like plink that PuTTY
FIPs as a standard only defines a certain set of algorithms that can be used. If enabled on a modern system it will downgrade the security since the standard references...
No because FIPS in windows eliminates most modern crypto algorithms making connections insecure so when enabled it cripples .Net crypto APIs used by SSH.Net Sent from my iPhone > On...