Listen to this Post
Introduction:
Windows Event Tracing for Threat Intelligence (ETW-TI) is a kernel‑level telemetry source that captures memory allocations, process injection primitives, APC abuse, thread hijacking, and more – the very data that modern EDR/AV solutions consume to make detection decisions. However, subscribing to ETW‑TI normally requires an ELAM‑signed driver and running your process as PS_PROTECTED_ANTIMALWARE_LIGHT, making it inaccessible to most security researchers. EtwTiViewer bypasses these restrictions using a test‑signed kernel driver and a live kernel debugger patch, allowing you to observe exactly what exploitation techniques leak to Microsoft’s threat intelligence pipeline.
Learning Objectives:
- Understand the architecture and importance of ETW‑TI in Windows security monitoring.
- Set up a test environment with test‑signed drivers and kernel debugging to run EtwTiViewer.
- Monitor real‑time telemetry from exploitation primitives and correlate it with EDR detection logic.
You Should Know:
- Setting Up the Test Environment for Kernel Driver Testing
EtwTiViewer relies on a test‑signed kernel driver. You must prepare a dedicated Windows VM (triage environment) with Secure Boot disabled and test signing enabled.
Step‑by‑step guide:
- Disable Secure Boot in your VM BIOS/UEFI settings.
2. Enable test signing from an elevated Command
bcdedit /set testsigning on
3. Reboot the VM. A watermark “Test Mode” appears on the desktop.
4. Install WinDbg (Microsoft Debugging Tools for Windows) for kernel debugging – either local or via COM/network.
5. Verify test signing mode:
bcdedit /enum | findstr testsigning
Expected output: `testsigning Yes`
Linux alternative: While no direct equivalent exists, you can compare with eBPF on Linux – e.g., `bpftrace -e ‘tracepoint:syscalls:sys_enter_openat { printf(“%s\n”, comm); }’` for syscall monitoring.
2. Building and Loading EtwTiViewer’s Kernel Driver
Compile the driver from the GitHub repository and sign it with a test certificate.
Step‑by‑step guide:
1. Clone the repository (expand LinkedIn shortlink):
git clone https://github.com/AdrianAnton/EtwTiViewer actual URL inferred; use lnkd.in/eWtY8BTC
2. Open the solution in Visual Studio with the Windows Driver Kit (WDK) installed.
3. Build the driver (Release/x64).
4. Create a test certificate (run as Administrator):
makecert -r -pe -ss My -n "CN=EtwTiViewer Test Cert" EtwTiViewer.cer
5. Sign the driver:
signtool sign /v /s My /n "EtwTiViewer Test Cert" /t http://timestamp.digicert.com EtwTiViewer.sys
6. Load the driver using OSR Loader or sc:
sc create EtwTiViewer type= kernel binPath= C:\path\to\EtwTiViewer.sys sc start EtwTiViewer
3. Patching Access Checks via Kernel Debugger (kd)
The driver itself does not bypass ELAM; instead, it patches the access check routine during a live kernel debug session. You need to attach WinDbg to the target VM.
Step‑by‑step guide:
- Configure kernel debugging on the target VM (e.g., COM port or network). Reboot with debugging enabled:
bcdedit /debug on bcdedit /dbgsettings serial debugport:1 baudrate:115200
- On the host, launch WinDbg and connect to the VM.
3. Break into the kernel (Ctrl+Break).
- Locate the access check function (symbols required) – typically `EtwTiAccessCheck` inside the driver.
5. Patch the function to always return success:
bp EtwTiViewer!AccessCheckRoutine g ; when breakpoint hits, modify assembly eb < address> 0x31 0xC0 0xC3 ; xor eax,eax / ret
6. Resume execution – the driver now operates without ELAM or protected process requirements.
Note: This is a research technique for triage VMs only. Microsoft may revoke test‑signing certificates in future updates.
4. Real‑Time Monitoring of Threat Intelligence Events
Run EtwTiViewer’s GUI to observe live ETW‑TI events as they occur on the system.
Step‑by‑step guide:
- Launch `EtwTiViewer.exe` as Administrator (the GUI uses DirectX 11 + Dear ImGui).
- Select the ETW‑TI provider from the provider list – usually
Microsoft-Windows-Threat-Intelligence.
3. Enable event categories such as:
- Memory allocation (
VirtualAllocEx) - Process injection (
CreateRemoteThread) - APC injection (
QueueUserAPC) - Thread hijacking (
SetThreadContext)
- Watch the live stream – each event shows process ID, call stack, and parameters.
- Export logs to JSON or CSV for offline analysis:
– Use the GUI’s “Export” button or capture via logman:
logman start EtwTiSession -p {provider-guid} -o etwti.etl -ets
Example event (memory allocation):
Time: 14:32:01.456 Process: 0x1234 (malware.exe) API: VirtualAllocEx Target: 0x1F0000 (RX region) Size: 4096 bytes
5. Simulating Exploitation Techniques to Test Telemetry
To understand what EDRs see, generate real exploitation primitives while EtwTiViewer is running.
Step‑by‑step guide:
1. Write a simple injector (C++):
include <windows.h>
int main() {
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, <PID>);
LPVOID p = VirtualAllocEx(hProcess, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(hProcess, p, shellcode, sizeof(shellcode), NULL);
CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)p, NULL, 0, NULL);
return 0;
}
2. Compile with MinGW or Visual Studio:
g++ injector.cpp -o injector.exe
3. Run the injector while EtwTiViewer monitors ETW‑TI. Observe events for VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
4. Compare with Windows Event Logs (Event ID 4688 for process creation, Sysmon events). Notice that ETW‑TI provides far more granular kernel‑level data.
Mitigation: EDRs use this telemetry to flag suspicious calls. To harden a system, you can block known injection patterns via Attack Surface Reduction rules (ASR) or enable kernel‑mode callbacks.
6. Hardening EDR Detections Using ETW‑TI Insights
Once you know exactly what telemetry leaves the endpoint, you can better tune detection rules or understand evasion gaps.
Step‑by‑step guide:
1. List all ETW providers related to security:
logman query providers | findstr -i "threat security microsoft-windows"
2. Enable verbose logging for a specific provider to see what EDRs might capture:
logman start "SecurityMonitor" -p "Microsoft-Windows-Threat-Intelligence" 0xffffffff 0xff -o ti.etl -ets
3. Simulate an EDR‑like rule – for example, alert when `CreateRemoteThread` targets a system process. Write a simple PowerShell script that polls ETW events (using Get-WinEvent):
$query = @" <QueryList><Query Id="0"><Select Path="Microsoft-Windows-Threat-Intelligence/Operational">[System[(EventID=1)]]</Select></Query></QueryList> "@ Get-WinEvent -FilterXml $query
4. Test evasion techniques like direct syscalls (e.g., NtCreateThreadEx) – EtwTiViewer will still show them because ETW‑TI hooks at the kernel level.
5. Apply hardening: Use `ConfigureDefender` to enable “Block process injections” and “Block executable files from running unless they meet a prevalence, age, or trusted list criterion.”
- Alternative Cross‑Platform Telemetry (Linux eBPF vs. Windows ETW)
While EtwTiViewer is Windows‑specific, understanding Linux’s equivalent helps broaden your telemetry analysis skills.
Step‑by‑step guide (Linux):
1. Install eBPF tools:
sudo apt install bpftrace linux-tools-common
2. Trace process injections (e.g., `ptrace` or `process_vm_writev`):
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_process_vm_writev { printf("%s writing to PID %d\n", comm, args->pid); }'
3. Monitor memory allocations (e.g., `mmap` with executable permissions):
sudo bpftrace -e 'kprobe:do_mmap { if (arg2 & 0x1) printf("executable mmap by %s\n", comm); }'
4. Compare telemetry richness: ETW‑TI on Windows is more opaque and protected, while eBPF is more accessible but requires root.
What Undercode Say:
- Key Takeaway 1: ETW‑TI is the crown jewel of Windows endpoint telemetry, but its strict access controls (ELAM + protected process) have historically hindered security researchers – EtwTiViewer democratizes this data for the first time.
- Key Takeaway 2: By observing real‑time telemetry from your own exploitation primitives, you can reverse‑engineer what EDR vendors actually see, enabling better evasion strategies or, conversely, more precise detection rules.
Analysis: The recent drama around Microsoft revoking code‑signing certificates has made it harder to load legitimate security tools, let alone research drivers. EtwTiViewer’s approach – using test signing and a live kernel debugger patch – is clever but fragile; future Windows updates may block test‑signed drivers from accessing ETW‑TI. Nonetheless, the tool exposes a critical gap: EDRs rely on telemetry that most defenders never get to inspect. This asymmetry is dangerous because blind trust in EDR telemetry leads to overconfidence. The open‑source release of EtwTiViewer is a wake‑up call – defenders should demand transparency and build their own telemetry validation pipelines.
Prediction:
As EDR killer tools become more sophisticated, attackers will increasingly target ETW‑TI itself – either by patching the kernel’s ETW routines or by exploiting the same access bypasses used by EtwTiViewer. Microsoft will likely respond by locking down test‑signing requirements further, possibly requiring attestation or virtualization‑based security (VBS) for any driver that consumes threat intelligence. In the long term, expect a shift toward hardware‑enforced telemetry (e.g., Intel PT) and cloud‑based behavioural analysis, making local ETW monitoring less effective. However, for the next 12–18 months, EtwTiViewer will become an essential tool in every Windows security researcher’s lab – and a blueprint for offensive tooling that blinds EDRs by cutting off their telemetry feed at the source.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Adri%C3%A1n Ant%C3%B3n – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
