ETW internals for security research and forensics
blog.trailofbits.com | research | #threat-intelligence | #malware | #windows | #detection | #trail-of-bits | #etw | #edr | #forensics | #detection-evasion | #threat-intel
Summary
Trail of Bits explains ETW internals — providers, consumers, and secure channels feeding EDR telemetry — and why attackers target ETW to bypass Windows detection and forensics.
- Published
- Collected
--- id: 1597 title: "ETW internals for security research and forensics" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2023/11/22/etw-internals-for-security-research-and-forensics/" published_at: "2023-11-22T12:00:12Z" tags: ["threat-intelligence", "malware", "windows", "detection", "trail-of-bits", "etw", "edr", "forensics", "detection-evasion", "threat-intel"] phying_url: "https://phying.com/item/1597" lang: en --- # ETW internals for security research and forensics ## Summary Trail of Bits explains ETW internals — providers, consumers, and secure channels feeding EDR telemetry — and why attackers target ETW to bypass Windows detection and forensics. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2023-11-22T12:00:12Z - **Original:** https://blog.trailofbits.com/2023/11/22/etw-internals-for-security-research-and-forensics/ - **Phying News:** https://phying.com/item/1597