anthrax3 / ghost-in-the-logs

Evade sysmon and windows event logging

Ghost In The Logs

This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here

Usage

You can grab the lastest release here

Starting off

Once you've got the latest version execute it with no arguments to see the avalible commands

$ gitl.exe

Loading the hook

$ gitl.exe load

Enabling the hook (disabling all logging)

$ gitl.exe enable

Disabling the hook (enabling all logging)

$ gitl.exe disable

Get status of the hook

$ gitl.exe status

Prerequisites

• High integrity administrator privilages

Credits

Huge thanks to:

• hfiref0x for the amazing KDU
• everdox for the super cool InfinityHook