Open-source endpoint detection engine for Windows and Linux

Rustinel은 Windows와 Linux에서 네이티브 호스트 텔레메트리를 수집하고 Sigma, YARA, IOC 룰을 평가하는 오픈소스 엔드포인트 탐지 엔진입니다. Rust로 구현되어 메모리 안전성과 성능을 보장하며, ETW(Windows)와 eBPF(Linux)를 활용해 이벤트를 수집하고 공통 모델로 정규화합니다. 탐지 결과는 SIEM 친화적인 ECS NDJSON 형식으로 출력되며, 악성 프로세스 종료 같은 능동 대응 기능도 지원합니다. 현재 Windows 지원이 더 광범위하며, Linux 지원 확대와 YARA 메모리 스캔 등 기능 추가가 계획되어 있습니다.

https://github.com/Karib0u/rustinel

#endpointdetection #rust #etw #ebpf #sigma

A room with a view🏖

Das ist die Aussicht aus des Mannes Kammer. Ein 70er Wohnschachtel-Dings mit Kratzputz. Mitten zwischen Gärten und Gründerzeit-Häuser gepflanzt. Einfach so. Plopp. Wenn man keinen Bock auf Häuser entwerfen hat, kann man doch was anderes machen ... Kammerjäger oder Kampfmittelräumdienst ... wird auch gebraucht und entspricht evtl mehr der persönlichen Neigung.

#Architektur #Schöner_Wohnen #70er #Aussicht #ETW

📢 Fuzzing récursif des structures MS-RPC avec ETW : escalade de privilèges vers SYSTEM
📝 ## 🔍 Contexte

Article technique publié le 4 mai 2026 par Remco van der Meer sur incendium.rocks, présentant des mises à jour...
📖 cyberveille : https://cyberveille.ch/posts/2026-05-06-fuzzing-recursif-des-structures-ms-rpc-avec-etw-escalade-de-privileges-vers-nt-authority-system/
🌐 source : https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/
#ETW #IOC #Cyberveille

FortiGuard IR researchers have highlighted unexpected forensic value in the AutoLogger-Diagtrack-Listener.etl file on modern Windows systems.

Despite low exploitation severity, the artefact has shown the ability to preserve historical process-execution data, including deleted binaries and command-line traces — helpful in ransomware investigations.

What’s your view on ETW-based artefacts in DFIR workflows?

Source: https://www.fortinet.com/blog/threat-research/uncovering-hidden-forensic-evidence-in-windows-mystery-of-autologger

Share your insights and follow us for more clear, unbiased analysis.

#InfoSec #DFIR #ThreatIntel #WindowsForensics #ETW #Telemetry #CyberSecurity #IncidentResponse #SecurityResearch #ThreatAnalysis

No Agent, No Problem: Discovering Remote #EDR

#Windows #ETW

https://jonny-johnson.medium.com/no-agent-no-problem-discovering-remote-edr-8ca60596559f

PerfView and TraceEvent 3.1.18

https://github.com/microsoft/perfview/releases/tag/v3.1.18

#dotnet #perf #etw #lttng #performance

ETW Forensics - Why use Event Tracing for Windows over EventLog? https://blogs.jpcert.or.jp/en/2024/11/etw_forensics.html

#etw #forensics #windows

Три слона, на которых держится логирование в Windows

Продолжаем наш цикл статей о типах и методах работы сборщиков данных с конечных точек, или, как принято их называть – агентов. В первой статье мы познакомились с этой сущностью и изучили основные нюансы сбора данных с их помощью. Так как мы в рамках разработки своих продуктов занимаемся и лог-менеджментом, и сбором событий, то хочется поделиться продолжением нашей обширной аналитики в quickstart формате. Поэтому в этом выпуске подробнее разберем функционал и используемые инструменты источников на ОС Windows.

https://habr.com/ru/companies/securityvison/articles/862352/

#Логирование #сбор_событий #eventlog #журналы_windows #журналы_событий #sysmon #event_tracing_for_windows #event_logging #event_log #etw

My program, which has a JIT compiler in it, is getting killed (or at least it seems like) on azure pipelines. when i turn the JIT off it runs fine. when i use IMAGE_NAME: 'windows-2019' instead of -latest, it runs fine.
Is there some kind of new security feature or exploit mitigation or whatever that was turned on some time between these two images that might be killing my program because the jit needs to be adapted to it?
How the heck do i find out how my program is actually quitting? "exit code 0xff" is not terribly enlightening ...
This is incredibly frustrating to debug, not just because I have to wait ~10 minutes between putting a change in and seeing the result, and the majority of tools windows developers have at their disposal seem to only be usable with a GUI which, surprise surprise, azure pipelines runners don't let you access.

#azurepipelines #msvc #windows #justintimecompilation #ETW #pwsh