Sysmon doing lines, part 2

Sysmon is a cool tool and we love it. Sometimes it does not work as expected though.

It’s late so just dropping another recipe here:

  • Name your DLL wevtapi.dll
  • Run sysmon.exe -u to … ‘uninstall’ it
  • Your DLL will be loaded

You can also drop Riched32.dll in the same directory and try to ‘install’ sysmon – you will notice the EULA box is loaded incorrectly, because the side-loaded Riched32.dll DLL will take over and will execute your code.