Most of the codes come from SEKTOR7 - Windows Evasion Course. This RDLL (requires SeDebugPrivilege privilege) will automatically locate sysmon process and patch its EtwEventWrite API, causing sysmon malfunctioning while the process and its threads are still running.

The effect lasts until next reboot / service restart

Version 1.1 (20220909)

• Adopted the RDLL from rapid7 to remove RWX section and apply section Characteristics

Load SysmonQuiet.cna

beacon> SysmonQuiet

• SEKTOR7 - Windows Evasion Course
• https://github.com/stephenfewer/ReflectiveDLLInjection
• https://github.com/rapid7/ReflectiveDLLInjection