https://github.com/improsec/SharpEventPersist

Persistence by writing/reading shellcode from Event Log
https://github.com/improsec/SharpEventPersist

Last synced: about 2 months ago
JSON representation

Persistence by writing/reading shellcode from Event Log

• Host: GitHub
• URL: https://github.com/improsec/SharpEventPersist
• Owner: improsec
• Created: 2022-05-20T14:52:56.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2022-05-27T14:52:02.000Z (over 2 years ago)
• Last Synced: 2024-08-05T17:25:59.099Z (6 months ago)
• Language: C#
• Size: 146 KB
• Stars: 364
• Watchers: 6
• Forks: 49
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - improsec/SharpEventPersist - Persistence by writing/reading shellcode from Event Log (C# #)

README

        
# SharpEventPersist

Persistence by writing/reading shellcode from Event Log.  

  

## Usage

The SharpEventPersist tool takes 4 case-sensitive parameters:  

* -file "C:\path\to\shellcode.bin"

* -instanceid 1337

* -source Persistence

* -eventlog "Key Management Service".  

The shellcode is converted to hex and written to the "Key Management Service", event level is set to "Information" and source is "Persistence".  

Run the SharpEventLoader tool to fetch shellcode from event log and execute it. Ideally this should be converted to a DLL and sideloaded on program start/boot.  

Remember to change the Event Log name and instanceId in the loader, if not running with default values.  

Default values will leave the following artifact:  

* A new key will be written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service named "Persistance".

* This new "Persistance" key will not have a provider GUID or TypesSupported which the default key "KmsRequests" have. This can be used to build detections.  

![image info](./demo.png)