ETW-PPL-Tester
March 26, 2026 ยท View on GitHub
A simple tool for exploring Microsoft-Windows-Threat-Intelligence (ETW-TI) events.
Note - some ETW-TI events must be additionally enabled on a per-process basis.
Requirements
- Windows 10+
- Administrator privileges
- Visual Studio 2022
Background
The ETW-TI provider can only be subscribed to by Antimalware-PPL processes. This protection level is intended for security products, and is typically granted to services associated with Early Launch AntiMalware (ELAM) drivers.
Pat H demonstrated two approaches to consuming ETW-TI -
- Gaining Threat-Intelligence the dodgy way - admin-to-PPL exploitation
- Gaining Threat-Intelligence the REALLY dodgy way - Bring Your Own Vulnerable Driver (BYOVD)
This project was originally a slightly more ergnomic version of Pat's BYOVD approach that I used to submit a bug report poc to Microsoft.
The second version updated to a BYOD approach using a driver that is not eligible for Microsoft's vulnerable driver blocklist. The nuance is that MSRC only considers user-to-kernel LPE as "vulnerabilities". If a driver allows admin-to-kernel LPE this is acceptable for submission for Windows Hardware Quality Labs (WHQL) signing. Admin-to-kernel is not a security boundary - it is "by design".
Further Reading
- Forget vulnerable drivers - Admin is all you need by Gabriel Landau