Skip to content
Real-time file monitoring on Windows with osquery
blog.trailofbits.com | blog | #endpoint-security | #windows | #detection | #trail-of-bits | #osquery | #ntfs | #file-monitoring
Summary
Trail of Bits built ntfs_journal_events, an event-based osquery table that taps the NTFS change journal for real-time Windows file monitoring, after surveying Win32 and minifilter approaches.
- Published
- Collected