ETWMonitor

Windows notifier tool that detects suspicious connections by monitoring ETW event logs

Server dashboard screen :

Crowdsec integration with IP address reputation :

Suspicious loaded DLL by processes detection :

Changelog

Final version :
– Loaded DLL by processes detections

V 2.3 :
– Crowdsec IP reputation integration (match ip in TCPIP logs)
– Alerts can be sent by email
– Statistics in server dashboard rely on real data
– Correction of bug that keeps CPU usage over 90%

V 2.1 :
– Client updates detection rules defined in a server XML file automatically
– No more compilation required for new rules creation

V 2.0 :
– Client-server support
– Client agent launched on startup as Windows service

V 1.1 :
– Detect and notify WinRM connections

V 1.0 :
– Detect and notify RDP, SMB and RPC connections

What da fuck is this ?

On Windows, ETW (for Event Tracing for Windows) is a mechanism to trace and log events that are raised
by user-mode applications and kernel-mode drivers.
ETWMonitor monitors events in real time to detect suspicious network connections.

Installation

– You can download latest compiled version from Release page
Also see installations instructions here : INSTALLATION HOW TO.pdf

Future improvements

No more improvements are planned for the moment.

Maintainability

Desktop version is no more maintained.
Only client-version will be maintained to get faster updates.
You can still add Agent version updates to Desktop version manually if needed.