private void psexecChanged(object sender, FileSystemEventArgs e)
{
//73802 = Possible Meterpreter
//15872 = Possible Psexec
try
{
FileInfo f = new FileInfo(e.FullPath);
string date = DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToShortTimeString();
string detect = "";
if (f.Length == 73802 && f.Name.Contains(".exe"))
{
detect = "Likely Meterpreter Executable";
w.write(date, e.FullPath, detect);
}
else if (f.Length == 15872 && f.Name.Contains(".exe"))
{
detect = "Likely PSExec Executable";
w.write(date, e.FullPath, detect);
}
}
catch (Exception)
{
return;
}
}