search

nasbench / EVTX-ETW-Resources

Event Tracing For Windows (ETW) Resources
MIT License
342 stars 68 forks source link

Enhancing manifests collection process #55

Open nasbench opened 2 months ago

nasbench commented 2 months ago

For some stupid reason, it's only now that i realized that WEPExplorer actually uses a CLI tool to do all the dumping (i don't know why it took me all this time LOL).

Anyway, this is a good thing for us, as we can streamline the collection process to simply running the tool.

I'm between writing a powershell script that make use of it or simply modify the code so that it does what we want.

This issue is here as a reminder for me to work on this :)

nasbench commented 2 months ago

See https://github.com/0xeb/WinTools/tree/master/WEPExplorer/cli

Example: cli.exe /meta /eventmeta /name "DptfAcpiEtwProvider" /out "Providers\DptfAcpiEtwProvider.xml"

AndrewRathbun commented 2 months ago

https://github.com/AndrewRathbun/DFIRPowerShellScripts/blob/main/GitHubProjects/EVTXETWResources/EVTXETWResources.ps1

Passing this along as well. I forget what exactly I used to run when I figured out there was a CLI....I'll have to do some digging and report back.

AndrewRathbun commented 2 months ago

Oh yeah, this is what makes the All.xml output:

.\cli.exe /out c:\temp\All.xml