tag :: ETW

• WMI Event Consumers: what are you missing?
• EQL to VQL - Leverage EQL based detection rules in Velociraptor
• ETW Part 2: Process Parent Spoofing
• Event Tracing for Windows Part 1