ETW Notes

Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.

Leaking kernel addresses from ETW consumers. Requires Administrator privileges.

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

An advanced profiler for .NET Applications on Windows

Greathelm is a modular Windows security service focused on process inspection, PowerShell telemetry, and automated response enforcement. It’s built entirely in C++ and designed for minimal dependencies, direct API usage.

Event Tracing For Windows (ETW) Resources

CPU profiling trace viewer

Shitty C++20 single-header ETW util for real-time event consumption and member parsing

Monitor windows kernel event, based on etw, development in rust. A replacement of procmon. more events and useful filter. Typically can check handle leak for a few weeks.

Basically a KrabsETW rip-off written in Rust

Command line tracing tool for Windows, based on ETW.

Command line tool to analyze one/many ETW file/s with simple queries for common issues.

Adversary tradecraft detection, protection, and hunting

Mentally ill EtwTi parser

Hades HIDS/HIPS for Windows

My notes on software troubleshooting, covering debugging and tracing techniques and tools. Available at wtrace.net.

NLog Target for Event Tracing for Windows (ETW)

See Through Your Network

Various Windows Performance files, scripts, settings and documents