ETW INTERNALS FOR SECURITY RESEARCH AND FORENSICS

Summary from the TLDR InfoSec newsletter

This post discusses the importance of Event Tracing for Windows (ETW) in endpoint detection and response solutions. It explores the internal workings of ETW and provides techniques to tamper with or bypass ETW-based EDRs, hook system calls, or gain access to ETW providers normally reserved for anti-malware solutions. The post also explains how to identify which processes are consuming ETW events.