TiEtwAgent

When compiling KrabsETW, you must manage specific preprocessor definitions to ensure successful compilation and correct runtime behavior:

• UNICODE: This is a required definition. The code will not compile without this flag. There is no support for compilation without UNICODE being set.
• NDEBUG: Use this in release builds to disable runtime type assertions. Note that even with NDEBUG, a runtime error will still occur if the requested size type does not match the property size in the event schema.
• TYPEASSERT: Use this only in debug builds (and do not set NDEBUG simultaneously). This enables strict assertions where a static_assert is thrown if an explicit type check is missing for a requested type. This is primarily intended for Krabs development to ensure all supported types have assertions.

If you prefer not to develop your own ELAM driver, you can use a pre-existing one from the PPLRunner project to facilitate the setup of TiEtwAgent.

https://github.com/pathtofile/PPLRunner/tree/main/elam_driver

TiEtwAgent requires a signed environment to run, typically involving an ELAM driver and test signing mode if you do not have a Microsoft-trusted certificate.

Follow these steps for setup:

1. Enable test signing mode on your machine using bcdedit.
2. Generate a self-signed certificate containing both ELAM and Code Signing EKU.
3. Sign both TiEtwAgent.exe and your ELAM driver with this certificate.
4. Install the agent using the CLI: ./TiEtwAgent install.
5. Start the service: net start TiEtwAgent.
6. Monitor activity via the default log file located at C:\Windows\Temp\TiEtwAgent.txt.

# Enable test signing (example command)
bcdedit /set testsigning on

# Install and start the agent
./TiEtwAgent install
net start TiEtwAgent

To implement new detection capabilities, you must modify the source code. Detection logic is centralized in DetectionLogic.cpp. You can add new detection functions there and invoke them within the detect_event(GenericEvent evt) function, which acts as the dispatcher for all incoming source event types.

If the new detection requires access to additional event fields, you must update the GenericEvent class declaration by appending the new field names to its internal map.

The krabs namespace provides two specialized trace classes for interacting with Event Tracing for Windows (ETW). Use user_trace when you need to monitor user-mode traces and kernel_trace when you need to monitor kernel-mode traces. These are type-aliased specializations of the base krabs::trace class using internal detail types krabs::details::ut and krabs::details::kt respectively.

#include <krabs/client.hpp>

// For monitoring user-mode ETW events
krabs::user_trace user_trace_instance;

// For monitoring kernel-mode ETW events
krabs::kernel_trace kernel_trace_instance;