ETW Threat Intelligence And Hardware Breakpoints
Security Boulevard, Thursday, January 23rd, 2025
Modern Endpoint Detection and Response (EDR) solutions rely heavily on Windows' Event Tracing for Windows (ETW) Threat Intelligence provider to detect malicious activity without compromising system stability.
However, adversaries continue to find ways to bypass these systems stealthily. By leveraging hardware breakpoints at the CPU level, attackers can hook functions and manipulate telemetry in userland without direct kernel patching-challenging traditional defenses.
Kernel Patch Protection (PatchGuard) prevents EDR vendors from hooking the System Service Descriptor Table (SSDT) to inspect function call arguments; the ETW Threat Intelligence provider becomes a crucial resource as it supplies various instrumentation data on activities such as memory allocation, thread manipulation, asynchronous procedure calls (APCs), and more from the kernel's perspective.