specify thread that a NT API belongs to

spender-sandbox / cuckoo-modified

Modified edition of cuckoo

392 stars 178 forks source link

Open william-vu opened 6 years ago

william-vu commented 6 years ago

Hi all, Cuckoo intercepts and logs the name and arguments of NT APIs. Is this possible to log the thread ID that calls these APIs? Thank you

kevoreilly commented 6 years ago

As far as I know there should be a 'TID' column in the behavioural analysis (or API) logs with the thread ID for each call.