tccontre / Reg-Restore-Persistence-Mole

a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Callback of sysmon driver filter. RegSaveKeyExW() and RegRestoreKeyW() API which is not included in monitoring. This POC will use
51Updated last year

Related projects

Alternatives and complementary repositories for Reg-Restore-Persistence-Mole