ETW internals for security research and forensics

By Yarden Shafir

Why has Event Tracing for Windows (ETW) become so pivotal for endpoint detection and response (EDR) solutions in Windows 10 and 11? The answer lies in the value of the intelligence it provides to security tools through secure ETW channels, which are now also a target for offensive researchers looking to bypass detections.

In this deep dive, we’re not just discussing ETW’s functionalities; we’re exploring how ETW works internally so you can conduct novel research or forensic …

detection detection and response edr endpoint endpoint detection endpoint detection and response event forensics intelligence lies offensive research researchers response security security research security tools solutions target tools tracing value windows windows 10