search

manorit2001 / c3i-malware-analysis

Real time system changes monitoring solution ( Project done at c3i IITK )
1 stars 3 forks source link

Windows API Monitoring through ETW #17

Open manorit2001 opened 3 years ago

manorit2001 commented 3 years ago

if we can extract the registry changes through ETW logs and map them to respective registry keys then it'll be good

manishkumarr1017 commented 3 years ago

We are trying to use the ETW to extract all the windows API functions that got hooked. This can be used to extract the process, registry and file changes.