admin/jdu2600-API-To-ETW
1
0
Fork 0
mirror of https://github.com/jdu2600/API-To-ETW synced 2026-06-06 15:54:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
John U
2024-07-26 17:07:58 +08:00
committed by GitHub
parent 5d4b4224c2
commit cdb4d914d2
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -15
View File
@@ -15,22 +15,22 @@ For example, the `Kernel-Audit-API-Calls` provider sounds interesting, but all o
Previously, this was a manual reversing process. Now you can run this Ghidra script on `ntoskrnl.exe` and grep the results. :smiley:
| Function | EVENT_DESCRIPTOR Symbol | Id | CallPath |
|--- | --- |--- |--- |--- |--- |--- |--- |--- |
| PsSetLoadImageNotifyRoutine | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | [PsSetLoadImageNotifyRoutine->PsSetLoadImageNotifyRoutineEx] |
| PsSetLoadImageNotifyRoutineEx | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | [PsSetLoadImageNotifyRoutineEx] |
| NtTerminateProcess | KERNEL_AUDIT_API_TERMINATEPROCESS | 2 | [NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent] |
| NtCreateSymbolicLinkObject | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | [NtCreateSymbolicLinkObject] |
| IoCreateSymbolicLink | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | [IoCreateSymbolicLink->IoCreateSymbolicLink2->ObCreateSymbolicLink] |
| NtSetContextThread | KERNEL_AUDIT_API_SETCONTEXTTHREAD | 4 | [NtSetContextThread] |
| NtOpenProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | [NtOpenProcess->PsOpenProcess] |
| NtAlpcOpenSenderProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | [NtAlpcOpenSenderProcess->PsOpenProcess] |
| NtOpenThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | [NtOpenThread->PsOpenThread] |
| NtAlpcOpenSenderThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | [NtAlpcOpenSenderThread->PsOpenThread] |
| IoRegisterLastChanceShutdownNotification | KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION | 7 | [IoRegisterLastChanceShutdownNotification->IopLogAuditIoRegisterNotificationEvent] |
| IoRegisterShutdownNotification | KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION | 8 | [IoRegisterShutdownNotification->IopLogAuditIoRegisterNotificationEvent] |
| --- | --- | --- | --- |
| PsSetLoadImageNotifyRoutine | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | PsSetLoadImageNotifyRoutine->PsSetLoadImageNotifyRoutineEx |
| PsSetLoadImageNotifyRoutineEx | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | PsSetLoadImageNotifyRoutineEx |
| NtTerminateProcess | KERNEL_AUDIT_API_TERMINATEPROCESS | 2 | NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent |
| NtCreateSymbolicLinkObject | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | NtCreateSymbolicLinkObjec |
| IoCreateSymbolicLink | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | IoCreateSymbolicLink->IoCreateSymbolicLink2->ObCreateSymbolicLink |
| NtSetContextThread | KERNEL_AUDIT_API_SETCONTEXTTHREAD | 4 | NtSetContextThread |
| NtOpenProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | NtOpenProcess->PsOpenProcess |
| NtAlpcOpenSenderProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | NtAlpcOpenSenderProcess->PsOpenProcess |
| NtOpenThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | NtOpenThread->PsOpenThread |
| NtAlpcOpenSenderThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | NtAlpcOpenSenderThread->PsOpenThread |
| IoRegisterLastChanceShutdownNotification | KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION | 7 | IoRegisterLastChanceShutdownNotification->IopLogAuditIoRegisterNotificationEvent |
| IoRegisterShutdownNotification | KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION | 8 | IoRegisterShutdownNotification->IopLogAuditIoRegisterNotificationEvent |
There are also trace providers (TraceLogging and WPP) which are not documented by design. This level of debug tracing is intended for the developer only, but might also prove useful for security. For example, the
`Microsoft.Windows.Kernel.SysEnv` TraceLogging provider includes a `SetVariable` event.
`Microsoft.Windows.Kernel.SysEnv` TraceLogging provider includes a `SetVariable` event which might be useful.
## Sample Output
@@ -68,4 +68,4 @@ I'm still missing support for some event write edge cases, but I've tried to fla
## Related Work
* https://github.com/jdu2600/Windows10EtwEvents
* https://github.com/jsecurity101/TelemetrySource
* https://github.com/airbus-cert/etwbreaker - an IDA plugin
* https://github.com/airbus-cert/etwbreaker - an IDA plugin