Most of the codes come from SEKTOR7 - Windows Evasion Course. This RDLL (requires SeDebugPrivilege privilege) will automatically locate sysmon process and patch its EtwEventWrite API, causing sysmon malfunctioning while the process and its threads are still running.
The effect lasts until next reboot / service restart
Version 1.1 (20220909)
- Adopted the RDLL from rapid7 to remove RWX section and apply section Characteristics
Load SysmonQuiet.cna
beacon> SysmonQuiet
- SEKTOR7 - Windows Evasion Course
- https://github.com/stephenfewer/ReflectiveDLLInjection
- https://github.com/rapid7/ReflectiveDLLInjection