corpus.blog
41554 blogs · 4,644,446 posts Claim your blog
Record · corpus.blog/posts/01a07df2-61c8-707d-b489-8c5af939c41a

Windows Internals: Check Your Privilege - The Curious Case of ETW’s SecurityTrace Flag

Connor McGarr · published 16 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at connormcgarr.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
13
Words captured
10,205

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.originhq.com/
originhq.com
https://www.originhq.com/blog/securitytrace-etw-ppl
originhq.com
https://www.preludesecurity.com/runtime-memory-protection
preludesecurity.com
https://www.alex-ionescu.com/the-evolution-of-protected-processes-pass-the-hash-mitigations-in-windows-8-1/
alex-ionescu.com
https://github.com/preludeorg/ThreatIntelligenceConsumer
github.com
https://blog.trailofbits.com/2023/11/22/etw-internals-for-security-research-and-forensics/
blog.trailofbits.com
https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-controltracew
learn.microsoft.com
https://jonny-johnson.medium.com/peeling-back-the-mask-how-the-threat-intelligence-provider-is-protected-9968c38c5481
jonny-johnson.medium.com
https://learn.microsoft.com/en-us/windows/win32/etw/consuming-events
learn.microsoft.com
https://github.com/microsoft/Detours
github.com
https://jonny-johnson.medium.com/behind-the-mask-unpacking-impersonation-events-fca909e08d00
jonny-johnson.medium.com
https://windows-internals.com/an-end-to-kaslr-bypasses/
windows-internals.com