{"repo":"nasbench/EVTX-ETW-Resources","free":true,"listed":false,"github":"https://github.com/nasbench/EVTX-ETW-Resources","clone":"git clone https://github.com/nasbench/EVTX-ETW-Resources.git","description":"Event Tracing For Windows (ETW) Resources","language":"Python","stars":434,"topics":["etw","windows","logging","detection","tracing","event-tracing-for-windows","windows11","windows10"],"license":"MIT","category":"analytics","readme_excerpt":"EVTX/ETW Resources This is a repository that contains a bunch of resources to learn and understand EVTX/ETW (Event Tracing for Windows) A Quick Rundown Here's what you can expect from each of the main subfolders within this repo. Please take a minute to educate yourself! ETWProvidersManifests ETWProvidersManifests will contain raw XMLs for each Event Log Provider for each respective version of Windows. At minimum, there should be 800 of these for each system. An example can be seen below: ETWProvidersCSVs ETWProvidersCSVs will contain a CSV for each Provider and all the possible event IDs, event messages, etc contained within that Provider. An example can be seen below: Within the ETWProvidersCSVs subfolder, there are two other subfolders that separate Windows-native and Third-Party Event Log Providers. Internal Any Event Log Provider that exists upon a clean install of Windows will be included here. ThirdParty Any Event Log Provider that doesn't ship with Windows will be included here. Some examples can include, but are not limited to: Third-Party Antivirus, Sysmon, Microsoft Office (technically doesn't ship with Windows), or Remote Admin Tools like Splashtop. ETWEventsList ETWEventsList will provide a CSV for each respective version of Windows that contains ALL of the possible event IDs, event messages, etc for that version of Windows. This is offered in a combined CSV for ALL Providers as well as each Provider separated out into their own CSV for that specific version of W","default_branch":null,"files":null,"tree":[],"storefront":"/r/nasbench","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/nasbench/EVTX-ETW-Resources/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}