KERNEL_AUDIT_API_SETCONTEXTTHREAD not logs for syswow64 process .

microsoft / krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

Other

592 stars 149 forks source link

KERNEL_AUDIT_API_SETCONTEXTTHREAD not logs for syswow64 process . #245

Open DefenderLab opened 5 days ago

DefenderLab commented 5 days ago

I am using "Microsoft-Windows-Kernel-Audit-API-Calls to monitor usage of "SetThreadContext" API. It is working fine for 64 bit process. But when I use 32 bit process which call SetThreadContext() API. The events does not generated by ETW provider. I have tested on widows 10 64 bit and Windows 11 64 bit OS.

Can someone help me to solve this issue?

swannman commented 4 days ago

Hi @DefenderLab, we're able to assist with issues where the event is being generated by the ETW provider but not being properly captured by krabsetw. If the event is not being generated by the ETW provider in the first place, then that isn't something we can help with.