Anyone aware of any extensions/PRs existing or currently in development that use Event Tracing for Windows (ETW) for real time eventing on Windows-specific stuff? PowerShell and WMI events for example?
11/14/2019, 11:32 PM
Alienvault has an implementation of process and network events using ETW. The schema is different than process_events. It's also based on v3.3.1 codebase. I didn't finish porting it to v4.x branch. It's based on this library: https://github.com/AlienVault-Engineering/libetw
KrabsETW is awesome. I was able to develop a PoC userland EDR tool with it that monitored like 8 high impact windows events in 2-3 weeks. I thought about trying to integrate that but thought maybe it would be too heavy.
I was just thinking how awesome it would be if osquery could monitor things like PowerShell, WMI, service changes, and task scheduler out of the box instead of having to make all the complex group policy changes in Windows audit configuration.
11/15/2019, 3:41 PM
KrabsETW is great and it covers all the different conditions. I originally looked at using it for events provider. However I was scared away by the size and use of schema and TDH lib to parse out all the properties. For an event source, you want to filter out and use only what you need. For that reason, I opted for direct use of ETW data structures and only parsing what is needed. One of these days I need to do some performance analysis and see if the Krabs overhead is insignificant.
11/15/2019, 4:08 PM
In theory I feel using ETW directly via TDH would be the way to go. When I was developing I used Microsoft message analyzer and it’s plugin for ETW event subscribers to help create the data filters and parse the fields I needed.
And yeah I am not sure about the weight of krabsetw but i remember it seemed very heavy at the time. Also in some ways it was convenient but there were instances where the extra layer of abstraction actually complicated things when I wanted to pull/parse data that wasn’t supported by krabsetw yet.
But yeah agree that it is a pretty intimidating task!
11/15/2019, 4:42 PM
Evented tables will tend to be heavy and with proper filters and control flags one can keep these tables usable. But either ways having these tables within core would be great addition without the need for some other agent like sysmon or extension when osquery is already installed.