New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Windows API Telemetry Category #79

Open

jdu2600 opened this issue Oct 19, 2024 · 0 comments

Contributor

jdu2600 commented Oct 19, 2024

A Category for Win32 API telemetry would be useful.

These are a primary data source for most EDRs. This data is available from Kernel ETW (especially Threat-Intelligence) or user-mode hooks.

Possible APIs to include are -

Local Executable Memory Events
- VirtualAlloc
- VirtualProtect
- MapViewOfFile
Remote Executable Memory Events
- VirtualAllocEx
- VirtualProtectEx
- MapViewOfFile2
Remote Process Manipulation Events
- QueueUserAPC
- SuspendThread
- SetThreadContext
- WriteProcessMemory
Remote Process Collection Events
- ReadProcessMemory
Driver Events
- DeviceIoControl
Keylogging Events
- RegisterRawInputDevices
- SetWindowsHookEx
- GetAsyncKeyState

jdu2600 changed the title ~~Add API Telemetry Category~~ Add Windows API Telemetry Category

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment