SharpNukeEventLog
nuke that event log using some epic dinvoke fu
Inspired by https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads and https://github.com/hlldz/Invoke-Phant0m
in order for this to compile you'll have to add System.Management to your refferences, which should be found here: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.5\System.Management.dll
Tested for x64 systems, pretty sure it wont work for x86 unless you do some magic with the IntPtr marshalling.
For red teamer, by a red teamer. I will not take part in the whole OST debate.
/\ |\**/|
/ \ \ == /
| | | |
| | EventlogNuker | |
/ == \ @jfmaes \ /
|/**\| \/
target found, nuke launched on the eventlog threads of PID: 1380
wevtsvc.dll found at 0x140733035708416
suspending eventlog thread 2204
suspending eventlog thread 2564
suspending eventlog thread 2568
suspending eventlog thread 2580
_.-^^---....,,--
_-- --_
< >)
| |
\._ _./
```--. . , ; .--'''
| | |
.-=|| | |=-.
`-=#$%&%$#=-'
| ; :|
_____.,-#%&$@%#&#~,._____
Eventlog nuked successfully!