Logging framework that can track events on both user- and kernel-level.
Components
Controllers
Component that manages ETW tracking in many aspects, .e.g. initiate or terminate sessions of tracing, establish or disable providers.
A commonly used controller is logman.exe.
Providers
Generates events and writes them to designated ETW sessions.
They have to be registered by applications to generate and transmit events.
They come in 4 types:
MOF Providers: based on Managed Object Format (MOF) and are capable of generating events according to predefined MOF schemas.WPP Providers: stands for Windows Software Trace Preprocessor and leverage specialised macros and annotations within the application’s source code to generate events. This type of provider is often utilised for low-level kernel-mode tracing and debugging purposes.Manifest-based Providers: rely on XML manifest files that define the structure and characteristics of events for enhanced flexibility and allowing for dynamic event generation and customisation.TraceLogging Providers: offer a simplified and efficient approach to event generation. They leverage the TraceLogging API, introduced in recent Windows versions, which streamlines the process of event generation with minimal code overhead.
Useful Providers for Forensics
Microsoft-Windows-Kernel-Process: instrumental in monitoring process-related activity within the Windows kernel. It can aid in detecting unusual process behaviours such as process injection, process hollowing, and other tactics commonly used by malware and advanced persistent threats (APTs).Microsoft-Windows-Kernel-File: focuses on file-related operations. It can be employed for detection scenarios involving unauthorised file access, changes to critical system files, or suspicious file operations indicative of exfiltration or ransomware activity.Microsoft-Windows-Kernel-Network: offers visibility into network-related activity at the kernel level. It’s especially useful in detecting network-based attacks such as data exfiltration, unauthorised network connections, and potential signs of command and control (C2) communication.Microsoft-Windows-SMBClient/SMBServer: monitor Server Message Block (SMB) client and server activity, providing insights into file sharing and network communication. They can be used to detect unusual SMB traffic patterns, potentially indicating lateral movement or data exfiltration.Microsoft-Windows-DotNETRuntime: focuses on .NET runtime events, making it ideal for identifying anomalies in .NET application execution, potential exploitation of .NET vulnerabilities, or malicious .NET assembly loading.OpenSSH: can provide important insights into Secure Shell (SSH) connection attempts, successful and failed authentications, and potential brute force attacks.Microsoft-Windows-VPN-Client: enables tracking of Virtual Private Network (VPN) client events. It can be useful for identifying unauthorised or suspicious VPN connections.Microsoft-Windows-PowerShell: tracks PowerShell execution and command activity, making it invaluable for detecting suspicious PowerShell usage, script block logging, and potential misuse or exploitation.Microsoft-Windows-Kernel-Registry: monitors registry operations, making it useful for detection scenarios related to changes in registry keys, often associated with persistence mechanisms, malware installation, or system configuration changes.Microsoft-Windows-CodeIntegrity: monitors code and driver integrity checks, which can be key in identifying attempts to load unsigned or malicious drivers or code.Microsoft-Antimalware-Service: can be employed to detect potential issues with the antimalware service, including disabled services, configuration changes, or potential evasion techniques employed by malware.WinRM: Monitoring the Windows Remote Management (WinRM) provider can reveal unauthorised or suspicious remote management activity, often indicative of lateral movement or remote command execution.Microsoft-Windows-TerminalServices-LocalSessionManager: tracks local Terminal Services sessions, making it useful for detecting unauthorised or suspicious remote desktop activity.Microsoft-Windows-Security-Mitigations: keeps tabs on the effectiveness and operations of security mitigations in place. It’s essential for identifying potential bypass attempts of these security controls.Microsoft-Windows-DNS-Client: gives visibility into DNS client activity, which is crucial for detecting DNS-based attacks, including DNS tunnelling or unusual DNS requests that may indicate C2 communication.Microsoft-Antimalware-Protection: monitors the operations of antimalware protection mechanisms. It can be used to detect any issues with these mechanisms, such as disabled protection features, configuration changes, or signs of evasion techniques employed by malicious actors.
Restricted Providers
Some providers are restricted in the sense that they are only accessible to processes that carry the required permissions.
Consumers
Subscribe to specific events of interest and receive those events for further processing or analysis.
By default, the events are typically directed to an ETL file (see below) for handling. However, an alternative consumer scenario involves leveraging the capabilities of the Windows API to process and consume the events.
Channels
Act as logical containers for organising and filtering events based on their characteristics and importance.
ETW supports multiple channels, each with its own defined purpose and audience.
Event consumers can selectively subscribe to specific channels to receive relevant events for their respective use cases.
ETL files
Files used to write events to disk.