Skip to content

Instantly share code, notes, and snippets.

@thinkst-cs

thinkst-cs/get_cmdline.reg

Created September 7, 2022 19:52
Show Gist options
  • Save thinkst-cs/c48d357c665a9b590623206b5e349e1d to your computer and use it in GitHub Desktop.
Save thinkst-cs/c48d357c665a9b590623206b5e349e1d to your computer and use it in GitHub Desktop.
Download ZIP
Monitoring Silent Process Exit
Raw
get_cmdline.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\nltest.exe]
"ReportingMode"=dword:00000001
"MonitorProcess"="powershell.exe -Command \"Get-WmiObject win32_process -Filter 'ProcessID = %e' | select CreationDate,ProcessId,CommandLine >> C:\\\\Test\\\\Logcmdline.txt\""
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment