Ghost-In-The-Logs — Kernel-level tool to disable Sysmon and Windows Event Logging via driver-based hook injection, enabling stealthy post-exploitation operations on Windows systems. | Kitploit

Ghost In The Logs

This tool allows you to evade sysmon and windows event logging, my blog post about it can be found here

Usage

You can grab the lastest release here

Starting off

Once you've got the latest version execute it with no arguments to see the avalible commands

$ gitl.exe

alt text

Loading the hook

$ gitl.exe load

alt text

Enabling the hook (disabling all logging)

$ gitl.exe enable

alt text

Disabling the hook (enabling all logging)

$ gitl.exe disable

alt text

Get status of the hook

$ gitl.exe status

alt text

Prerequisites

High integrity administrator privilages

Credits

Huge thanks to:

hfiref0x for the amazing KDU
everdox for the super cool InfinityHook