Links

[dobin]

https://github.com/jdu2600/conference_talks/blob/main/2024-07-bsidesbne-KernelETW.pdf
https://github.com/jdu2600/Windows10EtwEvents - greppable ETW events
https://github.com/jdu2600/Etw-SyscallMonitor - interesting kernel events
https://github.com/jdu2600/ETW-PPL-Tester - ETW-TI via BYOD (rather than TestSigning)
https://github.com/rabbitstack/fibratus - ETW
https://github.com/peasead/elastic-container - Elastic EDR is free, and you can bump event verbosity for red team use cases
https://github.com/microsoft/perfview - kernel events used for performance monitoring"

[dobin]

Fibratus: Similar concept, active development, Go. Can get inspiration.

https://github.com/jdu2600/Etw-SyscallMonitor/tree/main/src/ETW is a nice list of interesting providers, implement them