I'm In Your Logs Now, Deceiving Your Analysts and Blinding Your EDR | Olaf Hartong

### Overview In this presentation, Olaf Hartong demonstrates how Event Tracing for Windows (ETW)—an operating system facility designed originally for performance monitoring and debugging rather than security—can be manipulated to deceive security analysts, forge alerts, and blind Endpoint Detection and Response (EDR) agents. Because security tools such as Microsoft Defender for Endpoint, CrowdStrike, and Elastic rely extensively on ETW for visibility beyond standard kernel callbacks, fundamental architectural traits of ETW create exploitable weaknesses that allow unprivileged or low-privileged actors to spoof telemetry or exhaust logging capacities.

### Key Topics - **ETW Architecture and Security Products**: ETW connects providers (applications or drivers generating events), session controllers/the ETW kernel, and consumers (such as EDR agents). EDR vendors prefer ETW for stability (avoiding crash-prone kernel drivers), granular filtering, dynamic configuration, and broad coverage across hundreds of providers. - **Event Spoofing Without Elevation**: ETW allows any user-mode process to call `EventRegister` with a provider's GUID and emit events using `EventWrite`. While ETW attaches the authentic originating Process ID (preventing PID spoofing), it does not track which process registered or emitted the event, enabling attackers to inject arbitrary synthetic logs. - **Abusing Ingestion Caps to Blind Sensors**: Cloud-connected EDRs implement event capping to manage costs, performance, and bandwidth. Hartong discovered that by generating synthetic queries (such as random LDAP lookups) until hitting local or global 24-hour caps (e.g., 1,000 events), real offensive actions (such as SharpHound or AD Explorer activity) are completely dropped from telemetry. - **Buffer Exhaustion**: Trace sessions use kernel non-paged memory buffer pools. By launching an unconsumed trace session with maximum pool configurations and flooding events, the ETW kernel tells providers that buffers are full, dropping telemetry across all concurrent sessions listening to that provider—including the EDR.

### Technical Details - **Permissions and Registration**: ETW access control primarily protects event consumption via Security Descriptor Definition Language (SDDL) strings, leaving event emission largely unrestricted. Users in the `PerformanceLogUsers` group (which non-elevated accounts are often added to, such as when Visual Studio is installed) gain broad tracing rights. - **Telemetry Injection Nuances**: Writing custom events required accounting for Windows little-endian byte ordering and specific event header structures that off-the-shelf consumer-focused packages omitted. Using these techniques, Hartong was able to forge LDAP queries, AMSI events, and fake antivirus/ransomware detections. - **Tooling Released**: Hartong developed research utilities including *ProvMon* (to monitor provider registrations) and *Bamboozle EDR* (to automate event spoofing, telemetry flooding, and trace buffer exhaustion). - **Vendor Response**: After reporting to Microsoft, initial remediations only addressed the specific ransomware detection proof of concept and introduced signature detections against the POC binary, leaving the core architectural issues and 98+ other providers unpatched.

### Takeaways - **Defensive Blind Trust**: Security analysts must recognize that endpoint logs and SIEM data derived from ETW cannot be inherently trusted as immutable, ground truth evidence. - **Detection Opportunities**: Defenders can monitor for abnormal telemetry patterns—such as rapid volumetric spikes followed by total silence in specific log tables—or attempt provider registration monitoring (though registration logging is inherently noisy). - **Architectural Resolution**: Because event emission abuse and buffer suppression stem from kernel-level design choices within ETW, full remediation requires deep architectural adjustments by Microsoft rather than superficial signature blocks.