WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-07 02:07:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

refs

Browse Source
This commit is contained in:
SolitudePy
2025-05-07 19:55:30 +03:00
parent fc7e13f6f8
commit 9ddf2d9abb
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/etwpatch.py
+2 -1
View File
@@ -12,6 +12,8 @@ from volatility3.plugins.windows import pslist, pe_symbols
vollog = logging.getLogger(__name__)
# EtwpEventWriteFull -> https://github.com/SolitudePy/Stealthy-ETW-Patch
# CAPA rule -> https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
class EtwPatch(interfaces.plugins.PluginInterface):
"""Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection.
@@ -80,7 +82,6 @@ class EtwPatch(interfaces.plugins.PluginInterface):
kernel_module_name=self.config["kernel"],
filter_func=filter_func,
):
try:
proc_id = proc.UniqueProcessId
proc_name = utility.array_to_string(proc.ImageFileName)