From 94a029232848f34e0c8366ef145509a436d41c27 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 7 May 2025 19:05:05 +0300
Subject: [PATCH 1/4] add functions to etwpatch

---
 volatility3/framework/plugins/windows/etwpatch.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index 14fbacc28..2388bdcc7 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -30,10 +30,17 @@ class EtwPatch(interfaces.plugins.PluginInterface):
                 "EtwEventWrite",
                 "EtwEventWriteFull",
                 "NtTraceEvent",
+                "NtTraceEvent",
+                "ZwTraceEvent",
+                "NtTraceControl",
+                "ZwTraceControl",
+                "EtwpEventWriteFull"
             ],
         },
         "advapi32.dll": {
-            pe_symbols.wanted_names_identifier: ["EventWrite"],
+            pe_symbols.wanted_names_identifier: [
+                "EventWrite", 
+                "TraceEvent"],
         },
     }
 

From fc7e13f6f881f59a11ce428e9880608f2517b677 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 7 May 2025 19:30:58 +0300
Subject: [PATCH 2/4] black

---
 volatility3/framework/plugins/windows/etwpatch.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index 2388bdcc7..fb6375fd4 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -34,13 +34,11 @@ class EtwPatch(interfaces.plugins.PluginInterface):
                 "ZwTraceEvent",
                 "NtTraceControl",
                 "ZwTraceControl",
-                "EtwpEventWriteFull"
+                "EtwpEventWriteFull",
             ],
         },
         "advapi32.dll": {
-            pe_symbols.wanted_names_identifier: [
-                "EventWrite", 
-                "TraceEvent"],
+            pe_symbols.wanted_names_identifier: ["EventWrite", "TraceEvent"],
         },
     }
 

From 9ddf2d9abb5bb4bf820633e5345a033d6e70560f Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 7 May 2025 19:55:30 +0300
Subject: [PATCH 3/4] refs

---
 volatility3/framework/plugins/windows/etwpatch.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index fb6375fd4..b392f07ca 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -12,6 +12,8 @@ from volatility3.plugins.windows import pslist, pe_symbols
 vollog = logging.getLogger(__name__)
 
 
+# EtwpEventWriteFull -> https://github.com/SolitudePy/Stealthy-ETW-Patch
+# CAPA rule -> https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
 class EtwPatch(interfaces.plugins.PluginInterface):
     """Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection.
 
@@ -80,7 +82,6 @@ class EtwPatch(interfaces.plugins.PluginInterface):
             kernel_module_name=self.config["kernel"],
             filter_func=filter_func,
         ):
-
             try:
                 proc_id = proc.UniqueProcessId
                 proc_name = utility.array_to_string(proc.ImageFileName)

From f719efb9ec88317ae5af87586d1351673bb858a4 Mon Sep 17 00:00:00 2001
From: SolitudePy <47316655+SolitudePy@users.noreply.github.com>
Date: Wed, 7 May 2025 20:39:46 +0300
Subject: [PATCH 4/4] dupe

---
 volatility3/framework/plugins/windows/etwpatch.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index b392f07ca..476d0eea7 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -32,7 +32,6 @@ class EtwPatch(interfaces.plugins.PluginInterface):
                 "EtwEventWrite",
                 "EtwEventWriteFull",
                 "NtTraceEvent",
-                "NtTraceEvent",
                 "ZwTraceEvent",
                 "NtTraceControl",
                 "ZwTraceControl",