Uncovering Windows Events

Web: https://malware.news/t/uncovering-windows-events/67911

Threat Intelligence ETW

Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into telemetry sensors/EDR’s. One provider commonly that is leveraged by vendors is the Threat-Intelligence ETW provider. Due to how often it is used, I wanted to map out how its events are being written within TelemetrySource.

This post will focus on the process I followed to understand the events the Threat-Intelligence ETW provider logs and how to uncover the underlying …

events windows