Handle ETW events for process monitoring - Where ProcessId of EventHeader is our target process
| 30 | // Handle ETW events for process monitoring |
| 31 | // - Where ProcessId of EventHeader is our target process |
| 32 | void event_callback_process(const EVENT_RECORD& record, const krabs::trace_context& trace_context) { |
| 33 | try { |
| 34 | krabs::schema schema(record, trace_context.schema_locator); |
| 35 | |
| 36 | // Check if we observe the process which emitted this event |
| 37 | DWORD processId = record.EventHeader.ProcessId; |
| 38 | Process* process = g_ProcessResolver.getObject(processId); |
| 39 | if (process == NULL) { |
| 40 | LOG_A(LOG_WARNING, "ETW: No process object for pid %lu", processId); |
| 41 | return; |
| 42 | } |
| 43 | if (!process->observe) { |
| 44 | return; |
| 45 | } |
| 46 | |
| 47 | // Convert ETW to JSON |
| 48 | nlohmann::json j = KrabsEtwEventToJsonStr(record, schema); |
| 49 | j["etw_process"] = process->name; |
| 50 | |
| 51 | // Emit event |
| 52 | g_EventAggregator.NewEvent(j.dump()); |
| 53 | } |
| 54 | catch (const std::exception& e) { |
| 55 | LOG_A(LOG_ERROR, "ETW event_callback exception: %s", e.what()); |
| 56 | } |
| 57 | catch (...) { |
| 58 | LOG_A(LOG_ERROR, "ETW event_callback unknown exception"); |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | |
| 63 | // Handle ETW events for antimalware monitoring |