KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #developer-tools #ai-agent #claude-code #codex #typescript #ai-agents #deepseek-harness #mcp #cli #rust

ETWMonitor

★ 124 Open GitHub ↗

Windows notifier tool that detects suspicious connections by monitoring ETW event logs

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ETWMonitor

<div align="center">
<h2>Windows notifier tool that detects suspicious connections by monitoring ETW event logs</h2> 
 
 
 Server dashboard screen : 
<img src="https://github.com/Processus-Thief/ETWMonitor/raw/main/assets/ETWMonitor_server.PNG" width="80%;">
 
Crowdsec integration with IP address reputation : 
<img src="https://github.com/Processus-Thief/ETWMonitor/raw/main/assets/ETWMonitor_server2.PNG" width="80%;">
 
Suspicious loaded DLL by processes detection : 
<img src="https://raw.githubusercontent.com/Processus-Thief/ETWMonitor/main/assets/mimikatz_detection.PNG" width="80%;">
 
</div>

## Changelog
 
Final version : 
- Loaded DLL by processes detections 
 
V 2.3 : 
- Crowdsec IP reputation integration (match ip in TCPIP logs) 
- Alerts can be sent by email 
- Statistics in server dashboard rely on real data 
- Correction of bug that keeps CPU usage over 90% 
 
V 2.1 : 
- Client updates detection rules defined in a server XML file automatically 
- No more compilation required for new rules creation 
 
V 2.0 : 
- Client-server support 
- Client agent launched on startup as Windows service 
 
V 1.1 : 
- Detect and notify WinRM connections 
 
V 1.0 : 
- Detect and notify RDP, SMB and RPC connections

## What da fuck is this ?
 
On Windows, ETW (for Event Tracing for Windows) is a mechanism to trace and log events that are raised 
by user-mode applications and kernel-mode drivers. 
ETWMonitor monitors events in real time to detect suspicious network connections.

## Installation
 
- You can download latest compiled version from <a href="https://github.com/Processus-Thief/ETWMonitor/releases">Release page</a> 
Also see installations instructions here : <a href="https://github.com/Processus-Thief/ETWMonitor/blob/main/ETW%20Monitor%20-%20How%20to%20install%20client-server%20version.pdf">INSTALLATION HOW TO.pdf</a>
 
 
 
## Future improvements

No more improvements are planned for the moment.

## Maintainability
 
Desktop version is no more maintained. 
Only client-version will be maintained to get faster updates. 
You can still add Agent version updates to Desktop version manually if needed.

ETWMonitor

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README