search

cobbr / SharpSploit

SharpSploit is a .NET post-exploitation library written in C#
https://sharpsploit.cobbr.io/api/
BSD 3-Clause "New" or "Revised" License
1.75k stars 307 forks source link

Add ETW (Event Tracing for Windows) bypass #63

Closed salu90 closed 4 years ago

salu90 commented 4 years ago

Adds:

Disable ETW by patching the EtwEventWrite function in ntdll.dll.

Code has been kindly stolen and adapted from Adam Chester (https://blog.xpnsec.com/hiding-your-dotnet-etw/) and Mythic (https://github.com/its-a-feature/Mythic).

Tested on Windows 10 1909 and .NET Framework 4.8

salu90 commented 4 years ago

Thanks for the suggestion @rasta-mouse! I've added a line of code to restore the original memory permissions like in your AMSI patch.