---
id: 1597
title: "ETW internals for security research and forensics"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/11/22/etw-internals-for-security-research-and-forensics/"
published_at: "2023-11-22T12:00:12Z"
tags: ["threat-intelligence", "malware", "windows", "detection", "trail-of-bits", "etw", "edr", "forensics", "detection-evasion", "threat-intel"]
phying_url: "https://phying.com/item/1597"
lang: en
---

# ETW internals for security research and forensics

## Summary

Trail of Bits explains ETW internals — providers, consumers, and secure channels feeding EDR telemetry — and why attackers target ETW to bypass Windows detection and forensics.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2023-11-22T12:00:12Z
- **Original:** https://blog.trailofbits.com/2023/11/22/etw-internals-for-security-research-and-forensics/
- **Phying News:** https://phying.com/item/1597