Awesome

EVTX/ETW Resources

This is a repository that contains a bunch of resources to learn and understand EVTX/ETW (Event Tracing for Windows)

A Quick Rundown

Here's what you can expect from each of the main subfolders within this repo. Please take a minute to educate yourself!

ETWProvidersManifests

ETWProvidersManifests will contain raw XMLs for each Event Log Provider for each respective version of Windows. At minimum, there should be 800 of these for each system. An example can be seen below:

ETWProvidersCSVs

ETWProvidersCSVs will contain a CSV for each Provider and all the possible event IDs, event messages, etc contained within that Provider. An example can be seen below:

Within the ETWProvidersCSVs subfolder, there are two other subfolders that separate Windows-native and Third-Party Event Log Providers.

Internal

Any Event Log Provider that exists upon a clean install of Windows will be included here.

ThirdParty

Any Event Log Provider that doesn't ship with Windows will be included here. Some examples can include, but are not limited to: Third-Party Antivirus, Sysmon, Microsoft Office (technically doesn't ship with Windows), or Remote Admin Tools like Splashtop.

ETWEventsList

ETWEventsList will provide a CSV for each respective version of Windows that contains ALL of the possible event IDs, event messages, etc for that version of Windows. This is offered in a combined CSV for ALL Providers as well as each Provider separated out into their own CSV for that specific version of Windows. An example can be seen below:

Examples

Examples will contain example scripts to collect ETW events using different libraries.

Content

EVTX/ETW Resources

Blogs / Research (https://nasbench.medium.com/)

Tools

The following is a list of tools that can let us interact with the different ETW providers available. The examples directory contains example scripts and commands on how to use these tools

Interacting w/ ETW

Dumping ETW Providers Manifest

Scripting w/ ETW (Detection, Digital Forensics)

Online Resources

The following are blogs and articles published by the wider security community discussing various aspects of ETW