Skip to content

Instantly share code, notes, and snippets.

@Nexact
Created October 14, 2020 13:58
Show Gist options
  • Save Nexact/37959c1f8801a628c146a952d9c8c55c to your computer and use it in GitHub Desktop.
Save Nexact/37959c1f8801a628c146a952d9c8c55c to your computer and use it in GitHub Desktop.
Write log within Sysmon event log
using System;
using System.Collections.Generic;
using System.Diagnostics.Eventing.Reader;
using System.Linq;
using System.Text;
using System.Threading;
namespace ConsoleApp2
{
class Program
{
static void Main(string[] args)
{
const string sysmon = "Microsoft-Windows-Sysmon";
var logName = EventLogSession.GlobalSession.GetLogNames().First(l=>l.Contains("Sysmon"));
if (!EventLog.SourceExists(sysmon))
{
Console.WriteLine("Sysmon source does not exist");
EventLog.CreateEventSource(sysmon, logName);
Console.WriteLine("CreatedEventSource");
Console.WriteLine("Exiting, execute the application a second time to use the source.");
return;
}
// Create an EventLog instance and assign its source.
EventLog myLog = new EventLog();
myLog.Source = sysmon;
// Write an informational entry to the event log.
myLog.WriteEntry("Writing to event log.");
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment