| 271 | |
| 272 | |
| 273 | DWORD WINAPI TraceProcessingThread(LPVOID param) { |
| 274 | try { |
| 275 | // See https://github.com/jdu2600/Etw-SyscallMonitor/tree/main/src/ETW for nice events |
| 276 | |
| 277 | /* |
| 278 | 1 ProcessStart |
| 279 | 2 ProcessStop |
| 280 | 3 ThreadStart |
| 281 | 4 ThreadStop |
| 282 | 5 ImageLoad |
| 283 | 6 ImageUnload |
| 284 | 11 ProcessFreeze |
| 285 | */ |
| 286 | krabs::provider<> process_provider(L"Microsoft-Windows-Kernel-Process"); |
| 287 | std::vector<unsigned short> process_event_ids = { 1, 2, 3, 4, 5, 6, 11 }; |
| 288 | krabs::event_filter process_filter(process_event_ids); |
| 289 | process_provider.trace_flags(process_provider.trace_flags() | EVENT_ENABLE_PROPERTY_STACK_TRACE); |
| 290 | process_filter.add_on_event_callback(event_callback_process); |
| 291 | if (g_Config.do_defendertrace) { |
| 292 | process_filter.add_on_event_callback(event_callback_defendertrace); |
| 293 | } |
| 294 | process_provider.add_filter(process_filter); |
| 295 | trace_user.enable(process_provider); |
| 296 | LOG_A(LOG_INFO, "ETW: Microsoft-Windows-Kernel-Process (1, 2, 3, 4, 5, 6, 11)"); |
| 297 | |
| 298 | /* |
| 299 | Event ID 1: PspLogAuditSetLoadImageNotifyRoutineEvent(kernel) |
| 300 | Event ID 2: PspLogAuditTerminateRemoteProcessEvent |
| 301 | |
| 302 | Event ID 3: NtCreateSymbolicLink |
| 303 | Event ID 4: PspSetContextThreadInternal |
| 304 | Event ID 5: PspLogAuditOpenProcessEvent |
| 305 | Event ID 6: PspLogAuditOpenThreadEvent |
| 306 | |
| 307 | Event ID 7: IoRegisterLastChanceShutdownNotification(kernel) |
| 308 | Event ID 8: IoRegisterShutdownNotification(kernel) |
| 309 | */ |
| 310 | krabs::provider<> auditapi_provider(L"Microsoft-Windows-Kernel-Audit-API-Calls"); |
| 311 | std::vector<unsigned short> auditapi_event_ids = { 3, 4, 5, 6 }; |
| 312 | krabs::event_filter auditapi_filter(auditapi_event_ids); |
| 313 | auditapi_provider.trace_flags(auditapi_provider.trace_flags() | EVENT_ENABLE_PROPERTY_STACK_TRACE); |
| 314 | auditapi_filter.add_on_event_callback(event_callback_process); |
| 315 | if (g_Config.do_defendertrace) { |
| 316 | auditapi_filter.add_on_event_callback(event_callback_defendertrace); |
| 317 | } |
| 318 | auditapi_provider.add_filter(auditapi_filter); |
| 319 | trace_user.enable(auditapi_provider); |
| 320 | LOG_A(LOG_INFO, "ETW: Microsoft-Windows-Kernel-Audit-API-Calls (3, 4, 5, 6)"); |
| 321 | |
| 322 | /* |
| 323 | 10 NameCreate |
| 324 | 30 CreateNewFile |
| 325 | |
| 326 | 17 SetInformation |
| 327 | //22 QueryInformation |
| 328 | 19 Rename |
| 329 | 29 Rename9 |
| 330 | 25 DirNotify |