ScarredMonk/SysmonSimulator

Consider removing interactivity requirement for process terminate and process access events

dstaulcu opened this issue · 1 comments

dstaulcu commented

Consider removing interactivity requirement for process terminate and process access events

instead of prompting for ID of process to terminate or access just create a new and hidden notepad instance and operate on that instance.

this code is super helpful not just for learning but also for load and unit testing new sysmon releases. Thank you!

ScarredMonk commented

Hey @dstaulcu

Thanks for the suggestion. This has been done.

image

Added the new code and executable in releases

  • 👍1
  • 🚀1