Added BypassETW task

cobbr · Feb 6, 2021 · 5384760 · 5384760
1 parent 6b47491
commit 5384760
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added Covenant trace logging
 - Added ServiceBinary launcher, added PSExecCommand Task
 - Added OutputKind to LauncherForm
+- Added BypassETW task
 
 ### Changed
 - Disallow Administrators from changing other user's passwords

diff --git a/Covenant/Data/Tasks/SharpSploit.Evasion.yaml b/Covenant/Data/Tasks/SharpSploit.Evasion.yaml
@@ -42,7 +42,7 @@
     Description: SharpSploit is a library for C# post-exploitation modules.
     Location: SharpSploit\SharpSploit\
     Language: CSharp
-    CompatibleDotNetVersions: &o0
+    CompatibleDotNetVersions:
     - Net35
     - Net40
     ReferenceAssemblies:
@@ -91,9 +91,9 @@
     EmbeddedResources: []
   ReferenceAssemblies: []
   EmbeddedResources: []
-- Name: DisableETW
+- Name: BypassETW
   Aliases: []
-  Description: Disable ETW by patching the EtwEventWrite function.
+  Description: Bypass ETW by patching the EtwEventWrite function.
   Author:
     Name: 'Simone Salucci & Daniel López'
     Handle: 'saim1z, attl4s'
@@ -113,7 +113,7 @@
         {
             try
             {
-                if (ETW.PatchEtw())
+                if (ETW.PatchETWEventWrite())
                 {
                 	return "ETW Patch Succeeded.";
                 }
@@ -134,7 +134,7 @@
     Description: SharpSploit is a library for C# post-exploitation modules.
     Location: SharpSploit\SharpSploit\
     Language: CSharp
-    CompatibleDotNetVersions: &o0
+    CompatibleDotNetVersions:
     - Net35
     - Net40
     ReferenceAssemblies: