From cdb4d914d2a94c2fc7dae2a11aed090042c24fd6 Mon Sep 17 00:00:00 2001 From: John U <53329154+jdu2600@users.noreply.github.com> Date: Fri, 26 Jul 2024 17:07:58 +0800 Subject: [PATCH] Update README.md --- README.md | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index ffc54b5..0cb3a0e 100644 --- a/README.md +++ b/README.md @@ -15,22 +15,22 @@ For example, the `Kernel-Audit-API-Calls` provider sounds interesting, but all o Previously, this was a manual reversing process. Now you can run this Ghidra script on `ntoskrnl.exe` and grep the results. :smiley: | Function | EVENT_DESCRIPTOR Symbol | Id | CallPath | -|--- | --- |--- |--- |--- |--- |--- |--- |--- | -| PsSetLoadImageNotifyRoutine | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | [PsSetLoadImageNotifyRoutine->PsSetLoadImageNotifyRoutineEx] | -| PsSetLoadImageNotifyRoutineEx | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | [PsSetLoadImageNotifyRoutineEx] | -| NtTerminateProcess | KERNEL_AUDIT_API_TERMINATEPROCESS | 2 | [NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent] | -| NtCreateSymbolicLinkObject | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | [NtCreateSymbolicLinkObject] | -| IoCreateSymbolicLink | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | [IoCreateSymbolicLink->IoCreateSymbolicLink2->ObCreateSymbolicLink] | -| NtSetContextThread | KERNEL_AUDIT_API_SETCONTEXTTHREAD | 4 | [NtSetContextThread] | -| NtOpenProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | [NtOpenProcess->PsOpenProcess] | -| NtAlpcOpenSenderProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | [NtAlpcOpenSenderProcess->PsOpenProcess] | -| NtOpenThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | [NtOpenThread->PsOpenThread] | -| NtAlpcOpenSenderThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | [NtAlpcOpenSenderThread->PsOpenThread] | -| IoRegisterLastChanceShutdownNotification | KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION | 7 | [IoRegisterLastChanceShutdownNotification->IopLogAuditIoRegisterNotificationEvent] | -| IoRegisterShutdownNotification | KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION | 8 | [IoRegisterShutdownNotification->IopLogAuditIoRegisterNotificationEvent] | +| --- | --- | --- | --- | +| PsSetLoadImageNotifyRoutine | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | PsSetLoadImageNotifyRoutine->PsSetLoadImageNotifyRoutineEx | +| PsSetLoadImageNotifyRoutineEx | KERNEL_AUDIT_API_PSSETLOADIMAGENOTIFYROUTINE | 1 | PsSetLoadImageNotifyRoutineEx | +| NtTerminateProcess | KERNEL_AUDIT_API_TERMINATEPROCESS | 2 | NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent | +| NtCreateSymbolicLinkObject | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | NtCreateSymbolicLinkObjec | +| IoCreateSymbolicLink | KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT | 3 | IoCreateSymbolicLink->IoCreateSymbolicLink2->ObCreateSymbolicLink | +| NtSetContextThread | KERNEL_AUDIT_API_SETCONTEXTTHREAD | 4 | NtSetContextThread | +| NtOpenProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | NtOpenProcess->PsOpenProcess | +| NtAlpcOpenSenderProcess | KERNEL_AUDIT_API_OPENPROCESS | 5 | NtAlpcOpenSenderProcess->PsOpenProcess | +| NtOpenThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | NtOpenThread->PsOpenThread | +| NtAlpcOpenSenderThread | KERNEL_AUDIT_API_OPENTHREAD | 6 | NtAlpcOpenSenderThread->PsOpenThread | +| IoRegisterLastChanceShutdownNotification | KERNEL_AUDIT_API_IOREGISTERLASTCHANCESHUTDOWNNOTIFICATION | 7 | IoRegisterLastChanceShutdownNotification->IopLogAuditIoRegisterNotificationEvent | +| IoRegisterShutdownNotification | KERNEL_AUDIT_API_IOREGISTERSHUTDOWNNOTIFICATION | 8 | IoRegisterShutdownNotification->IopLogAuditIoRegisterNotificationEvent | There are also trace providers (TraceLogging and WPP) which are not documented by design. This level of debug tracing is intended for the developer only, but might also prove useful for security. For example, the -`Microsoft.Windows.Kernel.SysEnv` TraceLogging provider includes a `SetVariable` event. +`Microsoft.Windows.Kernel.SysEnv` TraceLogging provider includes a `SetVariable` event which might be useful. ## Sample Output @@ -68,4 +68,4 @@ I'm still missing support for some event write edge cases, but I've tried to fla ## Related Work * https://github.com/jdu2600/Windows10EtwEvents * https://github.com/jsecurity101/TelemetrySource - * https://github.com/airbus-cert/etwbreaker - an IDA plugin \ No newline at end of file + * https://github.com/airbus-cert/etwbreaker - an IDA plugin