PROCEDURES: Manual Commands

---

info

The purpose of this page is to procide the specific manual commands (🤮) to deploy the individual agents. It is intened that you combine or modify commands to suit your situation.

---

Sysmon

Install (PowerShell)

1. Prepare PS Session:

   Enable-PSRemoting -Force
   Set-Item "WSMan:\localhost\Client\TrustedHosts" -Value "*" -Force
   $SessionOption = New-PSSessionOption -MaximumReceivedObjectSize 1GB -OperationTimeout 0

2. Prepare installer material:

   # Installer paths
   $SysmonExe="<SYSMON_EXE>"
   $SysmonConfig="<SYSMON_XML_CONFIG>"

3. Store and test credentials against target:

   # Credentials
   $Credential = Get-Credential
   
   # Target
   $Target="<TARGET_IP/FQDN>"
   
   # Test if WinRM is available and credentials work
   Test-WSMan $Target -Credential $Credential -Authentication Negotiate

4. Deploy and initiate install:

   # Establish PSSession with target
   $PSSession = New-PSSession -ComputerName $Target -Credential $Credential -SessionOption $SessionOption
   
   # Mount target SMB drive
   $DriveName=$([Guid]::NewGuid().Guid.ToString())
   $PSDrive = New-PSDrive -Name $DriveName -PSProvider FileSystem -Credential $Credential -Root "\\$Target\C$"
   
   # Create install directory
   $TargetPath="\\$Target\C$\Program Files\Sysmon"
   New-Item -ItemType Directory -Path $TargetPath -Force
   
   # Upload installer
   Copy-Item -Force -Path $SysmonExe -Destination "$TargetPath\Sysmon.exe"
   Copy-Item -Force -Path $SysmonConfig -Destination "$TargetPath\sysmonconfig.xml"
   
   # Execute installer
   Invoke-Command -Session $PSSession {
       ."C:\Program Files\Sysmon\Sysmon.exe" -accepteula -i "C:\Program Files\Sysmon\sysmonconfig.xml"
       Get-Service "sysmon64","sysmon"
   }
   
   # Cleanup
   Remove-Item -Force "$TargetPath\sysmonconfig.xml"
   Remove-PSDrive $PSDrive
   Remove-PSSession $PSSession

Uninstall (PowerShell)

1. Prepare PS Session:

   Enable-PSRemoting -Force
   Set-Item "WSMan:\localhost\Client\TrustedHosts" -Value "*" -Force
   $SessionOption = New-PSSessionOption -MaximumReceivedObjectSize 1GB -OperationTimeout 0

2. Store credentials and target:

   # Credentials
   $Credential = Get-Credential
   
   # Target
   $Target="<TARGET_IP/FQDN>"

3. Initiate uninstall:

   # Establish PSSession with target
   $PSSession = New-PSSession -ComputerName $Target -Credential $Credential -SessionOption $SessionOption
   
   # Execute uninstall
   Invoke-Command -Session $PSSession {
       ."C:\Program Files\Sysmon\Sysmon.exe" -accepteula -u -force
       Remove-Item -Force "C:\Program Files\Sysmon"
   }
   
   # Cleanup
   Remove-PSSession $PSSession

---