mySYSMON

#free bugs, use for reference only
#free bugs, use for reference only



Function poc-dns1 {
    [CmdletBinding()]
    param(
      #[Parameter(Mandatory=$true)]

mySYSMON

$events = Get-WinEvent -FilterHashtable `
@{ ` 
    logname='Microsoft-Windows-Sysmon/Operational'; `
    id=1; `
    StartTime=(Get-Date).AddHours(-1); `
    EndTime=get-date `
} 
$dict = @{}
foreach ($log in $events)
{

mySYSMON

#include <windows.h>
#include <conio.h>
#include <stdio.h>
#include <winevt.h>

#pragma comment(lib, "wevtapi.lib")

#define ARRAY_SIZE 10

DWORD EnumerateResults(EVT_HANDLE hResults);