Real-time file monitoring on Windows with osquery

Published

2020-03-16 11:12

Collected

2026-07-03 04:17

---
id: 1878
title: "Real-time file monitoring on Windows with osquery"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2020/03/16/real-time-file-monitoring-on-windows-with-osquery/"
published_at: "2020-03-16T11:12:42Z"
tags: ["endpoint-security", "windows", "detection", "trail-of-bits", "osquery", "ntfs", "file-monitoring"]
phying_url: "https://phying.com/item/1878"
lang: en
---

# Real-time file monitoring on Windows with osquery

## Summary

Trail of Bits built ntfs_journal_events, an event-based osquery table that taps the NTFS change journal for real-time Windows file monitoring, after surveying Win32 and minifilter approaches.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2020-03-16T11:12:42Z
- **Original:** https://blog.trailofbits.com/2020/03/16/real-time-file-monitoring-on-windows-with-osquery/
- **Phying News:** https://phying.com/item/1878