This is a repository that contains a bunch of resources to learn and understand EVTX/ETW (Event Tracing for Windows)
Here's what you can expect from each of the main subfolders within this repo. Please take a minute to educate yourself!
ETWProvidersManifests will contain raw XMLs for each Event Log Provider for each respective version of Windows. At minimum, there should be 800 of these for each system. An example can be seen below:
ETWProvidersCSVs will contain a CSV for each Provider and all the possible event IDs, event messages, etc contained within that Provider. An example can be seen below:
Within the ETWProvidersCSVs subfolder, there are two other subfolders that separate Windows-native and Third-Party Event Log Providers.
Any Event Log Provider that exists upon a clean install of Windows will be included here.
Any Event Log Provider that doesn't ship with Windows will be included here. Some examples can include, but are not limited to: Third-Party Antivirus, Sysmon, Microsoft Office (technically doesn't ship with Windows), or Remote Admin Tools like Splashtop.
ETWEventsList will provide a CSV for each respective version of Windows that contains ALL of the possible event IDs, event messages, etc for that version of Windows. This is offered in a combined CSV for ALL Providers as well as each Provider separated out into their own CSV for that specific version of Windows. An example can be seen below:
Examples will contain example scripts to collect ETW events using different libraries.
The following is a list of tools that can let us interact with the different ETW providers available. The examples directory contains example scripts and commands on how to use these tools
The following are blogs and articles published by the wider security community discussing various aspects of ETW
If you want to contribute to this project simply follow these steps: