Skip to content

Iorpim/EventInjector

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 

Repository files navigation

EventInjector

Tool for injecting events into Windows Event log


Usage

EventInjector is a command line tool, for usage details use EventInjector -h.

"-" and "/" are interchangeable.

Limitations

Windows allows for any user, even unprivileged, to write in Application log as any other user, System and Security, however, require permissions. For System log, administrator permissions are necessary, while Security log requires generate auditing events permission, with running as Local System being the simplest way to achieve all requirements with the least of registry/GPO modifications.

Application logs are indiscernible from legitimate events, but System events show minor differences as it appears to use a different API to register events.

About

Tool for injecting events into Windows Event log

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages