How I Hunted a Meterpreter C2 Session Using Sysmon

Introduction The attacker was already inside. A reverse shell was open, a flag file had been stolen, and Windows Defender was quietly switched off. But none of that happened in silence — Sysmon was watching the entire time. In this post I'm breaking down exactly how I detected a live Meterpreter C2