14. Grzegorz Tworek - The Good, the Bad and the ETW

### Overview In this presentation, Grzegorz Tworek (also introducing himself as Greg), Malware Security Lead Engineer at Standard Chartered, provides a practical crash course on Windows monitoring mechanisms with a primary focus on Event Tracing for Windows (ETW). Aimed at blue teamers, red teamers, system administrators, and developers, the talk surveys built-in Windows telemetry options before diving into the architecture, security configurations, sniffing opportunities, and evasion or triggering techniques associated with ETW.

### Key Topics - **Windows Monitoring Landscape**: A comparison of various built-in diagnostic and monitoring facilities, including classic Event Logs, Performance Counters, debug output (monitored via Sysinternals DebugView), Windows Software Trace Preprocessor (WPP), In-Flight Trace Recorder (IFR) kept in circular memory dumps, and kernel black boxes for boot and services. - **ETW Architecture**: Introduction to the core ETW engine, introduced in Windows Vista, which connects controllers, event providers, and consumers, with support for live sessions (`-ets`) and binary event trace log (`.etl`) files. - **Provider Management and Manifests**: Inspecting and discovering providers using native command-line utilities (`logman query providers`) and registry keys (`HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security` and Autologgers). Demonstrating manifest extraction from binary hard links using Resource Hacker to view `WEVT_TEMPLATE` resources. - **Access Control & Permissions**: Analyzing security descriptors in the registry and utilizing PowerShell to parse provider ACLs and SDDL strings to see which accounts (Local System, Administrators, Authenticated Users) can read or write events. - **Blinding & Evasion**: Demonstrating how unregistering providers, tampering with Autologger registry values (`Enable`), or setting the environment variable `COMPlus_ETWEnabled=0` disables .NET ETW telemetry inside processes.

### Technical Details - **Native CLI Commands**: Tworek relies heavily on built-in tools like `logman` (e.g., `logman query -ets`, `logman start osk -p "Microsoft-Windows-OSK" -o osk.etl -ets`, `logman stop osk -ets`) and `tracerpt` (e.g., `tracerpt osk.etl -o osk.xml`) to collect and convert traces without third-party dependencies. - **Sniffing with ETW**: The speaker highlights sensitive telemetry that ETW providers capture, including cleartext HTTP/HTTPS data via `WinINet` before TLS encapsulation, network frames via built-in packet providers, USB bus traffic, and on-screen keyboard keystrokes via `Microsoft-Windows-OSK`. Tworek demonstrates sniffing OSK inputs, extracting `tcID` values from the resulting XML trace, and mapping those decimal scan codes to raw keyboard inputs. - **Service Triggering via ETW**: Demonstrating that while an unprivileged regular user receives an `error 5` (access denied) when attempting to start a service such as the Windows Error Reporting Service (`WerSvc`), the service configuration has an ETW event trigger (`sc qtriggerinfo WerSvc`). By calling the undocumented `ntdll.dll` export `EtwEventWriteNoRegistration`, an unprivileged user can emit the trigger event and cause the Service Control Manager to start the target service. - **Ecosystem Tools**: Recommending utilities such as Microsoft Message Analyzer, TraceView (SDK/WDK), FireEye's SilkETW, Pavel Yosifovich's ETW Explorer, Zac Brown's Posh-ETW, and Airbus CERT's WinShark.

### Takeaways ETW provides an extremely powerful, low-overhead monitoring architecture with over a thousand native providers, but its security implications cut both ways. Administrators and defenders must recognize that ETW can expose sensitive cleartext data (keystrokes, network frames, decrypted web traffic), can be blinded via registry manipulation or environment variables, and can even be abused by unprivileged users to indirectly execute actions such as triggering service starts.