unknown 263c81c60d small fix		пре 2 година
..
README.md	5416b5594f Update README.md	пре 2 година
beacon.h	db89d9b285 first commit	пре 2 година
bofcompile.bat	db89d9b285 first commit	пре 2 година
findsysmon.c	263c81c60d small fix	пре 2 година
findsysmon.cna	263c81c60d small fix	пре 2 година
findsysmon.disasm	263c81c60d small fix	пре 2 година
findsysmon.h	db89d9b285 first commit	пре 2 година
findsysmon.o	263c81c60d small fix	пре 2 година

FindSysmon

Verify if Sysmon is running. This can be done by checking the registry or by enumerating Minifilter drivers and search for one that is associated with Sysmon.

Options

reg: search the registry to check if Sysmon is present on the system and return the Sysmon service PID if active.
driver: list all the Minifilter drivers on the system and check manually if a minifilter is present that is associated with Sysmon (requires elevated privileges).

Usage

findsysmon <reg | driver>

Compile

1. Make sure Visual Studio is installed and supports C/C++.
2. Open the x64 Native Tools Command Prompt for VS <2019/2022> terminal.
3. Run the bofcompile.bat script to compile the object file.
4. In Cobalt strike, use the script manager to load the .cna script to import the tool.