Microsoft Can Fix Ransomware Tomorrow

Re:Microsoft Can Fix Ransomware Tomorrow by markus_zhang on Friday July 14, 2023 @01:14PM (#36726875)

Can you please elaborate how to use ETW to profile system calls?

[ Parent | on HN ]

Re:Microsoft Can Fix Ransomware Tomorrow by EvanAnderson on Friday July 14, 2023 @01:17PM (#36726933)

Yeah— that’s what I can’t do. I know Process Monitor can do it, so the API is there, but it’s not an API I’ve ever used.

That’s the research I’ve been putting off for 5+ years.

[ Parent | on HN ]

Re:Microsoft Can Fix Ransomware Tomorrow by markus_zhang on Friday July 14, 2023 @01:25PM (#36727054)

Thanks, I'm going to take a look of the ETW doc.

[ Parent | on HN ]