09.08.2026

Inside Event Tracing for Windows with EtwSuite

Ido Veltzman
starforkfollow
Table Of Contents
Event Tracing for Windows (ETW) is one of the richest sources of telemetry available on Windows. It can expose activity from the kernel, drivers, services, frameworks, and applications, but the provider models, sessions, and metadata can make it difficult to approach as a researcher or defender.
In this video, I walk through the ETW ecosystem, look at what happens when providers register and sessions start, and demonstrate how EtwSuite can turn those events into a practical research workflow.

What the Video Covers

  • ▸

    The ETW architecture: providers, controllers, consumers, and the session infrastructure that connects them.

  • ▸

    Classic, WPP, manifest-based, and TraceLogging providers, including the practical limitations and access restrictions that matter when consuming them.

  • ▸

    How ETW is initialized during boot, how providers register, and how a controller creates a tracing session.

  • ▸

    Using EtwSuite to find providers, consume live events, filter results, and record or export traces for later analysis.

  • ▸

    A UAC-bypass case study that compares benign and malicious requests to identify useful detection signals.

EtwSuite as a Research Tool

EtwSuite is a Windows-native ETW inspection suite built to make the full workflow easier to work with from one desktop application. You can browse registered providers, inspect their metadata, collect live events, and save recordings as ETL, JSON, or CSV files.
That combination is especially useful when exploring an unfamiliar provider. Rather than writing a consumer before knowing whether a provider exposes the fields you need, you can inspect the manifest, generate a controlled event, and compare the resulting telemetry directly in the tool.

From Telemetry to Detection

The demonstration uses the Microsoft Antimalware UAC Scan provider to compare a normal elevation request with a UAC bypass. By examining the requesting process, request type, trust state, auto-elevation information, command line, and related COM data, it becomes possible to identify signals that distinguish the two cases.
The important takeaway is not a single static rule. It is the research process: select a relevant provider, collect benign and suspicious samples, compare the fields that change, and then validate the resulting detection against more real-world activity.

Get Started

If you want to follow along, download EtwSuite from the project repository and use the video as a starting point for exploring the providers on your own system.