WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-12 20:57:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed plugin docs

Browse Source
This commit is contained in:
Elad Levi
2025-04-28 15:18:53 +00:00
parent 817bd5ce7f
commit c5a4b34bfa
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/plugins/windows/etwpatch.py
+7 -1
View File
@@ -12,7 +12,13 @@ from volatility3.plugins.windows import pslist, pe_symbols
vollog = logging.getLogger(__name__)
class EtwPatch(interfaces.plugins.PluginInterface):
"""Detects ETW patching by examining the first opcode of EtwEventWrite in ntdll.dll."""
"""Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection.
This plugin examines the first opcode of key ETW functions in ntdll.dll and advapi32.dll
to detect common ETW bypass techniques such as return pointer manipulation (RET) or function
redirection (JMP). Attackers often patch these functions to prevent security tools from
receiving telemetry about process execution, API calls, and other system events.
"""
_version = (1, 0, 0)
_required_framework_version = (2, 26, 0)