Record · corpus.blog/posts/01a08778-e061-7066-a991-c1022f57753f

Full spectrum Event Tracing for Windows detection in the kernel against rootkits

fluxsec.red · published 30 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at fluxsec.red Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 27
Words captured: 7,921

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/0xflux/Ferric-Fox

github.com

https://github.com/0xflux/Sanctum

github.com

https://www.sonicwall.com/blog/remcos-rat-targets-europe-new-amsi-and-etw-evasion-tactics-uncovered

sonicwall.com

https://whiteknightlabs.com/2021/12/11/bypassing-etw-for-fun-and-profit/

whiteknightlabs.com

https://www.phrack.me/tools/2023/04/10/Patching-ETW-in-C.html

phrack.me

https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/

mdsec.co.uk

https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions

binarly.io

EDR Evasion ETW patching in Rust Read at the source ↗

fluxsec.red

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day

decoded.avast.io

Intro and plan for the Sanctum EDR Read at the source ↗

fluxsec.red

https://x.com/0xfluxsec

x.com

Monitoring NTDLL for in memory patching Read at the source ↗

fluxsec.red

Theory: EDR Syscall hooking and Ghost Hunting, my approach to detection Read at the source ↗

fluxsec.red

https://github.com/0xflux/Ferric-Fox/blob/master/src/etw.rs

github.com

https://github.com/0xflux/Sanctum/blob/main/driver/src/core/etw_mon.rs

github.com

https://github.com/0xflux/wdk-mutex

github.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_REG_ENTRY

vergiliusproject.com

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/

decoded.avast.io

https://attack.mitre.org/groups/G0032/

attack.mitre.org

https://blog.quarkslab.com/reversing-windows-container-episode-i-silo.html

blog.quarkslab.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_SILODRIVERSTATE

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_HASH_BUCKET

vergiliusproject.com

https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_GUID_ENTRY

vergiliusproject.com

https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63

blog.palantir.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-cmregistercallbackex

learn.microsoft.com

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-cmunregistercallback

learn.microsoft.com

https://github.com/0xflux/Sanctum/blob/main/driver/src/core/registry.rs

github.com