41554 blogs · 4,417,066 posts Claim your blog

Record · corpus.blog/posts/01a08778-e061-7066-a991-c1022d4c2e5a

Reading Event Tracing for Windows Threat Intelligence

fluxsec.red · published 2 February 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 14
Words captured: 2,795

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

EDR Evasion ETW patching in Rust Read at the source ↗

EDR Evasion APC Queue Injection in Rust Read at the source ↗

Theory: EDR Syscall hooking and Ghost Hunting, my approach to detection Read at the source ↗

Creating a Protected Process Light in Rust for Sanctum EDR Read at the source ↗

https://github.com/0xflux/Sanctum/blob/main/sanctum_ppl_runner/src/logging.rs

github.com

https://github.com/0xflux/Sanctum/blob/main/sanctum_ppl_runner/src/tracing.rs

github.com

https://learn.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-starttracew

learn.microsoft.com

https://microsoft.github.io/windows-docs-rs/doc/windows/Win32/System/Diagnostics/Etw/struct.CONTROLTRACE_HANDLE.html

microsoft.github.io

https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-enabletraceex2

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_logfilew

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/evntrace/nf-evntrace-opentracew

learn.microsoft.com

https://learn.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_record

learn.microsoft.com

https://github.com/0xflux/Sanctum/tree/e861d80cf00317280d29b1add7b573778daae772

github.com