From c5a4b34bfa5f1466b61551768ea0ad61becbc200 Mon Sep 17 00:00:00 2001
From: Elad Levi <99.elad.levi@gmail.com>
Date: Mon, 28 Apr 2025 15:18:53 +0000
Subject: [PATCH] Fixed plugin docs

---
 volatility3/framework/plugins/windows/etwpatch.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py
index 1ecedea3f..3605dfccb 100644
--- a/volatility3/framework/plugins/windows/etwpatch.py
+++ b/volatility3/framework/plugins/windows/etwpatch.py
@@ -12,7 +12,13 @@ from volatility3.plugins.windows import pslist, pe_symbols
 vollog = logging.getLogger(__name__)
 
 class EtwPatch(interfaces.plugins.PluginInterface):
-    """Detects ETW patching by examining the first opcode of EtwEventWrite in ntdll.dll."""
+    """Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection.
+    
+    This plugin examines the first opcode of key ETW functions in ntdll.dll and advapi32.dll 
+    to detect common ETW bypass techniques such as return pointer manipulation (RET) or function 
+    redirection (JMP). Attackers often patch these functions to prevent security tools from 
+    receiving telemetry about process execution, API calls, and other system events.
+    """
 
     _version = (1, 0, 0)
     _required_framework_version = (2, 26, 0)