This is a demonstration version of how to monitoring Windows console (starting from Windows 8). The concept was based on the 2-part articles of fireeye blog but source code wasn't revealed, so i decide to write a POC for my own. Let me know if you want some more features.
The 2-part articles of fireeye blog can be viewed here:
https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html
- VS2019
- WDK10.0.18362
- Process and Message Association
- Handling
IOCTL_CONDRV_READ_IOFunction
\Device\ConMonCan't be deleted.
https://github.com/EyeOfRa/WinConMon
