From 1712a0f239f8d5fbb37ddd8514ff121b6b047e6d Mon Sep 17 00:00:00 2001 From: thefLink Date: Wed, 19 Apr 2023 18:24:21 +0200 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 57f23ca..4046717 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ This project uses ``ETW``, more precisely kernel based ETW providers, to monitor This allows monitoring IOCs indicating direct and indirect syscalls, a technique often leveraged by threat actors: 1: A syscall was conducted from an untrusted module (=direct syscall) -2: The used syscall stub does not match the conducted syscall (=indirect syscall) +2: The used syscall stub in ntdll does not match the conducted syscall (=indirect syscall) This project uses the Provider: ``Microsoft-Windows-Kernel-Audit-API-Calls`` to monitor for ``OpenThread`` and ``SetContextThread`` events triggered by the syscalls ``NtSetContextThread`` or ``NtOpenThread`` respectively. Calltraces are enabled, using the flag ``EVENT_ENABLE_PROPERTY_STACK_TRACE``.