#Etw
Showing 9 of 9 repositories tagged #etw, ranked by stars
Adversary tradecraft detection, protection, and hunting
Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.
The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能， 而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发
Basically a KrabsETW rip-off written in Rust
Windows native ETW inspection suite for browsing providers, reading metadata, consuming live events, recording ETL traces, filtering results, and inspecting ETL/JSON/CSV recordings from one desktop tool.
Go library for ETW (Event Tracing for Windows) events processing
Event Tracing for Windows EDR bypass in Rust (usermode)
Open source HIDS tailored for Microsoft Windows and Active Directory
A simple example application to collect DNS queries logs using etw-api