Saturday, May 18, 2024

SilkETW – New Free Threat Intelligence Tool to Capture and Analyze Windows Events Logs

SilkETW is a flexible tool aimed to reduce the complexities of ETW(Event Tracing for Windows) and to put actionable data in the hands of researches on both the defensive and offensive side.

ETW is a kernel-level tracing facility that allows tracing the kernel logs or application-defined events logs. SilkETW makes the job straightforward by providing an interface for data collection, various filtering mechanics, and an output format that can be easily processed.

“SilkETW is not solely a defensive tool. ETW data can be used for diagnostics, it can help in reverse engineering, vulnerability research, detection, and evasion.”


SilkETW developed by FireEye, it provides a simple interface to record trace data and the output can be extracted is JSON format.

The extracted data can be imported to PowerShell locally or to 3rd party infrastructure such as Elasticsearch for event filtering.

The tool is developed.Net v4.5, a number of 3rd party libraries and Yara functionality to filter or tag event data.

By having the data in hand it is easy to filter the exact event that you want to trace, here researchers demonstrated by identifying a Mimikatz execution.

Also, the SilkETW includes a number of command line flags that allow the user to restrict the events that are captured.

It includes the following capabilities such as event name, the process ID, the process name, and the opcode.

The data collection can be triggered by using the command .NET ETW data and the “-yo” option here indicates that it will write only the Yara matches to file.

SilkETW.exe -t user -pn Microsoft-Windows-DotNETRuntime -uk 0x2038 -l verbose -y
C:\Users\b33f\Desktop\yara -yo matches -ot file -p C:\Users\b33f\Desktop\yara.json

SilkETW is currently research focused data-collection tool with robust yet rudimentary capabilities. the tool can be downloaded on GitHub.

Learn : Complete Hacking Tools in Kali Linux Operating System

Also Read:

A Complete Penetration Testing & Hacking Tools List for Hackers & Security Professionals

Most Important Security Tools and Resources For Security Researcher and Malware Analyst

fsociety a Complete Hacking Tools pack that a Hacker Needs – Penetration Testing Framework

These are the Top 5 Publicly Available Hacking Tools Mostly used By Hackers


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles